Unable to boot system after upgrade to Fedora 41 - selinux issue

Ask Fedora
1

Hi everyone,
after upgrading my system to Fedora 41 beta I cannot boot system in selinux enforcing mode. Systemd stuck on start of systemd-vconsole-setup.service, when I boot system in permissive mode system boots without any issues but generates a lot of selinux alerts. I already tried to autorelabel the whole system and restore selinux contex of specific files - without any effect. Any toughs on that? I would be grateful for any help. Thanks.
systemd-vconsole-setup journal message:

Sep 25 17:58:49 hp840 systemd-vconsole-setup[301]: /usr/bin/setfont failed with a "system error" (EX_OSERR), ignoring.
Sep 25 17:58:49 hp840 systemd-vconsole-setup[309]: setfont: ERROR kdfontop.c:183 put_font_kdfontop: Unable to load such font with such kernel version
Sep 25 17:58:49 hp840 systemd-vconsole-setup[301]: Setting source virtual console failed, ignoring remaining ones.
Sep 25 17:58:49 hp840 systemd[1]: Finished systemd-vconsole-setup.service - Virtual Console Setup.
Sep 25 17:58:50 hp840 systemd[1]: systemd-vconsole-setup.service: Deactivated successfully.
Sep 25 17:58:50 hp840 systemd[1]: Stopped systemd-vconsole-setup.service - Virtual Console Setup.
Sep 25 17:58:50 hp840 systemd[1]: Stopping systemd-vconsole-setup.service - Virtual Console Setup...
Sep 25 17:58:50 hp840 systemd[1]: Starting systemd-vconsole-setup.service - Virtual Console Setup...
Sep 25 17:58:50 hp840 systemd-vconsole-setup[606]: setfont: ERROR kdfontop.c:183 put_font_kdfontop: Unable to load such font with such kernel version
Sep 25 17:58:50 hp840 systemd-vconsole-setup[584]: /usr/bin/setfont failed with a "system error" (EX_OSERR), ignoring.
Sep 25 17:58:50 hp840 systemd-vconsole-setup[584]: Setting source virtual console failed, ignoring remaining ones.
Sep 25 17:58:50 hp840 systemd[1]: Finished systemd-vconsole-setup.service - Virtual Console Setup.
Sep 25 17:59:11 hp840 systemd[1]: systemd-vconsole-setup.service: Deactivated successfully.
Sep 25 17:59:11 hp840 systemd[1]: Stopped systemd-vconsole-setup.service - Virtual Console Setup.
Sep 25 17:59:11 hp840 systemd[1]: Stopping systemd-vconsole-setup.service - Virtual Console Setup...
Sep 25 17:59:11 hp840 systemd[1]: Starting systemd-vconsole-setup.service - Virtual Console Setup...
Sep 25 17:59:11 hp840 systemd[1]: Finished systemd-vconsole-setup.service - Virtual Console Setup.
Sep 25 17:59:16 hp840 systemd[1]: systemd-vconsole-setup.service: Deactivated successfully.
Sep 25 17:59:16 hp840 systemd[1]: Stopped systemd-vconsole-setup.service - Virtual Console Setup.
Sep 25 17:59:16 hp840 systemd[1]: Stopping systemd-vconsole-setup.service - Virtual Console Setup...
Sep 25 17:59:16 hp840 systemd[1]: Starting systemd-vconsole-setup.service - Virtual Console Setup...
Sep 25 17:59:16 hp840 systemd-vconsole-setup[1694]: Couldn't open /dev/tty1
Sep 25 17:59:16 hp840 systemd-vconsole-setup[1683]: /usr/bin/loadkeys failed with exit status 1.
Sep 25 17:59:16 hp840 systemd[1]: systemd-vconsole-setup.service: Main process exited, code=exited, status=1/FAILURE
Sep 25 17:59:16 hp840 systemd[1]: systemd-vconsole-setup.service: Failed with result 'exit-code'.
Sep 25 17:59:16 hp840 systemd[1]: Failed to start systemd-vconsole-setup.service - Virtual Console Setup.

Selinux alert:

type=AVC msg=audit(1727281305.583:252): avc:  denied  { read write } for  pid=1610 comm="systemd-logind" name="tty2" dev="devtmpfs" ino=21 scontext=system_u:system_r:systemd_logind_t:s0 tcontext=unconfined_u:object_r:device_t:s0 tclass=chr_file permissive=1

tty devices with secontex:

crw-rw-rw-. 1 root     tty system_u:object_r:devtty_t:s0     5, 0 Sep 25 18:45 /dev/tty
crw--w----. 1 root     tty system_u:object_r:device_t:s0     4, 1 Sep 25 18:21 /dev/tty1
crw--w----. 1 grzegorz tty unconfined_u:object_r:device_t:s0 4, 2 Sep 25 18:21 /dev/tty2
crw--w----. 1 root     tty system_u:object_r:device_t:s0     4, 3 Sep 25 18:21 /dev/tty3
crw--w----. 1 root     tty system_u:object_r:device_t:s0     4, 4 Sep 25 18:21 /dev/tty4
2

Strange. The tty devices should be labeled system_u:object_r:tty_device_t unless you have a non-standard selinux configuration.

3

Well, previously I had a problem with missing selinux context on the whole /dev directory (screenshot) but autorelabeling was able to handle that (maybe not completely). I do not use any custom selinux policy.

photo_2024-09-25_19-55-52
photo_2024-09-25_19-55-521280×720 205 KB

Setroubleshoot errors:

Sep 25 19:47:35 hp840 /usr/bin/sealert[4509]: attempt to open server connection failed: Connection refused
Sep 25 19:47:36 hp840 setroubleshoot[6035]: failed to retrieve rpm info for path '/dev/input/event6':
Sep 25 19:47:37 hp840 setroubleshoot[6035]: SELinux is preventing systemd-logind from ioctl access on the chr_file /dev/input/event6. For complete SELinux messages run: sealert -l 629a0a5a-8147-48a4-b8ec-8a09484d8fbd
Sep 25 19:47:38 hp840 setroubleshoot[6035]: SELinux is preventing systemd-logind from 'read, write' accesses on the chr_file event6. For complete SELinux messages run: sealert -l bd845148-4786-417c-9341-fb18427ca627
Sep 25 19:47:38 hp840 setroubleshoot[6035]: SELinux is preventing systemd-logind from open access on the chr_file /dev/input/event6. For complete SELinux messages run: sealert -l 354a8f2f-66c1-4487-8119-ddbb5432d439
Sep 25 19:47:38 hp840 setroubleshoot[6035]: SELinux is preventing dbus-broker from 'read, write' accesses on the chr_file /dev/input/event6. For complete SELinux messages run: sealert -l 7691549f-578b-4179-8348-e755732dfc3e
Sep 25 19:53:30 hp840 setroubleshoot[6695]: SELinux is preventing systemd-timedat from read access on the chr_file rtc0. For complete SELinux messages run: sealert -l e60f7ccc-70e3-4948-be3f-b37d7c96e680
Sep 25 19:53:30 hp840 setroubleshoot[6695]: failed to retrieve rpm info for path '/dev/rtc0':
Sep 25 19:53:30 hp840 setroubleshoot[6695]: SELinux is preventing systemd-timedat from open access on the chr_file /dev/rtc0. For complete SELinux messages run: sealert -l e7a4376c-fd6d-4dea-bf5d-ec611d970da7
Sep 25 19:53:30 hp840 setroubleshoot[6695]: SELinux is preventing systemd-timedat from ioctl access on the chr_file /dev/rtc0. For complete SELinux messages run: sealert -l 4e5ec559-fbe1-4d97-8ec8-638a33aa55c9

UPDATE
I was able to resolve my problem by deleting all custom selinux labels that I created during my troubleshooting. Commands that I used:

semanage fcontext -D
fixfiles -F onboot
reboot

After that labels on tty devices are exactly the same as @vekruse provided. Thanks for helping.

Reference: My big error on selinux - #5 by lesar