edited
Quick question, has anyone else experienced problems with flatpak update after system-upgrade to f36 beta?
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Warning: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Warning: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Error: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Error: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Error: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Warning: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Warning: Failed to get revokefs-fuse socket from system-helper: User flatpak does not exist in password file entry
Error: Can't open system repo default: While opening repository /var/lib/flatpak/repo: opening repo: opendir(/var/lib/flatpak/repo): Permission denied
Updates complete.
In F35 and all previous releases I was able to flatpak install and flatpak update without using sudo.
/etc/passwd has the following entry (equal to another F36 VM where I am not experiencing this issue)
....
flatpak:x:985:982:User for flatpak system helper:/:/sbin/nologin
....
I had a different error yesterday, but maybe it was due to no disk space left.
I did a lot of cleaning (including old flatpak packages) and today the update works.
Sorry, the problem was with rpm-ostree update actually, as it needs at least 3% disk space left while I’m at 1% (4.5 GB).
I guess SELinux is the issue here.
It has been reported as BZ #2070350 and BZ 2053631, and BZ #2070739
SELinux is preventing flatpak-system- from read access on the file /etc/passwd.
***** Plugin catchall (100. confidence) suggests **************************
If you believe that flatpak-system- should be allowed read access on the passwd file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'flatpak-system-' --raw | audit2allow -M my-flatpaksystem
# semodule -X 300 -i my-flatpaksystem.pp
Additional Information:
Source Context system_u:system_r:flatpak_helper_t:s0
Target Context system_u:object_r:passwd_file_t:s0
Target Objects /etc/passwd [ file ]
Source flatpak-system-
Source Path flatpak-system-
Port <Unknown>
Host (removed)
Source RPM Packages
Target RPM Packages setup-2.13.9.1-3.fc36.noarch
SELinux Policy RPM selinux-policy-targeted-36.5-1.fc36.noarch
Local Policy RPM flatpak-selinux-1.12.7-1.fc36.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name (removed)
Platform Linux fedora 5.17.0-300.fc36.x86_64 #1 SMP PREEMPT
Wed Mar 23 22:00:40 UTC 2022 x86_64 x86_64
Alert Count 22
First Seen 2022-03-31 19:34:29 CEST
Last Seen 2022-03-31 19:41:49 CEST
Local ID fc946152-35fc-4a45-a3cb-7bf5907a69a3
Raw Audit Messages
type=AVC msg=audit(1648748509.54:891): avc: denied { read } for pid=3734 comm="pool-/usr/libex" name="passwd" dev="dm-1" ino=2884699 scontext=system_u:system_r:flatpak_helper_t:s0 tcontext=system_u:object_r:passwd_file_t:s0 tclass=file permissive=0
Hash: flatpak-system-,flatpak_helper_t,passwd_file_t,file,read
There was a bunch of subsequent selinux-policy errors, which I didn’t manage to fix by creating local policy modules unfortunately.
This is likely related to a recent discussion about boot failures after an update that was selinux related. I have posted to that discussion but unfortunately at the moment I cannot find it.
In any case the command sudo restorecon -vR / should relabel everything and may fix the selinux errors you are seeing.
I did that command and had a lot of flatpak files/packages relabeled on 3 different systems.