Unable to install packages due to invalid argument error from restorecon

Ask Fedora
, ,
1

I believe this issue occurred because I upgraded from Fedora 39 to 41. Running dnf update after the upgrade updated about 500 packages (upgraded a while ago, but I think this is the first time I’m running dnf update since then), however not all of them successfully. Some failed during the “[3/4] Installing” phase with the error “Invalid argument”, see below for the full output of dnf.

I have removed all offending packages and tried to install them again which resulted in the same error, also after restarting the system. However, before removing them I ran restorecon -v <path_to_executeable> which also resulted in that “Invalid argument” error which I can’t explain. The file exists but restorecon was unable to change it’s selinux label? Never had this happen, though I’m not an expert in selinux.

Please help me fix this. I have seen this issue with these packages: podman, passt, swtpm and some docker packages which i have removed and don’t need anymore.

Here is the dnf log for installing podman:

Updating and loading repositories:
Repositories loaded.
Package                                                                  Arch             Version                                                                   Repository                                    Size
Installing:
 podman                                                                  x86_64           5:5.4.0-1.fc41                                                            updates                                   49.4 MiB
Installing dependencies:
 conmon                                                                  x86_64           2:2.1.12-3.fc41                                                           fedora                                   166.4 KiB

Transaction Summary:
 Installing:         2 packages

Total size of inbound packages is 16 MiB. Need to download 0 B.
After this operation, 50 MiB extra will be used (install 50 MiB, remove 0 B).
Is this ok [y/N]: y
[1/2] podman-5:5.4.0-1.fc41.x86_64                                                                                                                                            100% |   0.0   B/s |   0.0   B |  00m00s
>>> Already downloaded                                                                                                                                                                                                
[2/2] conmon-2:2.1.12-3.fc41.x86_64                                                                                                                                           100% |   0.0   B/s |   0.0   B |  00m00s
>>> Already downloaded                                                                                                                                                                                                
----------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------
[2/2] Total                                                                                                                                                                   100% |   0.0   B/s |   0.0   B |  00m00s
Running transaction
[1/4] Verify package files                                                                                                                                                    100% |  54.0   B/s |   2.0   B |  00m00s
[2/4] Prepare transaction                                                                                                                                                     100% |   4.0   B/s |   2.0   B |  00m00s
[3/4] Installing conmon-2:2.1.12-3.fc41.x86_64                                                                                                                                100% |  10.9 MiB/s | 167.8 KiB |  00m00s
>>> [RPM] lsetfilecon: (40 /usr/bin/conmon;67c3aaa2, system_u:object_r:conmon_exec_t:s0) Invalid argument                                                                                                             
>>> [RPM] Plugin selinux: hook fsm_file_prepare failed                                                                                                                                                                
>>> [RPM] unpacking of archive failed on file /usr/bin/conmon;67c3aaa2: cpio: (error 0x2)                                                                                                                             
>>> Unpack error: conmon-2:2.1.12-3.fc41.x86_64                                                                                                                                                                       
[1/4] Installing podman-5:5.4.0-1.fc41.x86_64                                                                                                                                 100% | 489.0 MiB/s |  49.4 MiB |  00m00s
>>> [RPM] conmon-2:2.1.12-3.fc41.x86_64: install failed                                                                                                                                                               
>>> [RPM] lsetfilecon: (40 /usr/bin/podman;67c3aaa2, system_u:object_r:container_runtime_exec_t:s0) Invalid argument                                                                                                  
>>> [RPM] Plugin selinux: hook fsm_file_prepare failed                                                                                                                                                                
>>> [RPM] unpacking of archive failed on file /usr/bin/podman;67c3aaa2: cpio: (error 0x2)                                                                                                                             
>>> Unpack error: podman-5:5.4.0-1.fc41.x86_64                                                                                                                                                                        
Transaction failed: Rpm transaction failed.
2

You should temporarily switch SELinux to permissive mode:

sudo setenforce 0
sudo restorecon ...
sudo setenforce 1

A safer option is to relabel the filesystem on boot:

sudo fixfiles -F onboot
sudo reboot

If the issue persists, check the output:

journalctl --no-pager -b _AUDIT_TYPE_NAME=AVC

That’s likely a bug you need to report.

As a workaround, create a permissive module:
audit2allow | policycoreutils-python-utils Commands | Man Pages | ManKier

3

Searching for selinux events with sudo ausearch -m avc -ts recent resulted in some events which pointed to an issue with my own root certificate authority. Fixing the selinux lables for that crt file using restorecon might have fixed my issue. Now dnf installs normally.

1 Like
4

I am very reluctant to disable selinux enforcing, but also haven’t used the on boot relabeling since I am afraid it would break something and not let the system boot. Is it generally safe to do fixfiles?

5

Permissive mode is specifically useful for troubleshooting.

This is generally the safest relabeling method.

1 Like