Summary
After a bootc deployment switch triggered by an OS image update (flightctl-agent on RHEL 9 bootc, managed via Red Hat Edge Manager / flightctl), /usr/bin/flightctl-agent ends up with SELinux context unlabeled_t on overlay. systemd cannot exec the agent under SELinux enforcing; the service restart-loops and the device stops checking in to management.
On a fresh install before any deployment switch, the same binary has the correct label:
# Before any OS image change
# ls -Z /usr/bin/flightctl-agent
system_u:object_r:flightctl_agent_exec_t:s0 /usr/bin/flightctl-agent
After switch + reboot:
# ls -Z /usr/bin/flightctl-agent
system_u:object_r:unlabeled_t:s0 /usr/bin/flightctl-agent
Example AVC:
avc: denied { execute } for pid=2143 comm="(tl-agent)" name="flightctl-agent" dev="overlay"
scontext=system_u:system_r:init_t:s0 tcontext=system_u:object_r:unlabeled_t:s0 tclass=file
trawcon="system_u:object_r:flightctl_agent_exec_t:s0"
systemd:
flightctl-agent.service: Failed to locate executable /usr/bin/flightctl-agent: Permission denied
flightctl-agent.service: Failed at step EXEC spawning /usr/bin/flightctl-agent: Permission denied
Disabling SELinux works around it. restorecon on /usr does not persist because /usr is read-only on bootc; temporary fix via bootc usr-overlay is lost on reboot.
Reproducibility
Reproduces when switching to the same image content with only a different tag (not caused by image content changes).
Steps to reproduce
- Build a RHEL 9 bootc image that installs
flightctl-agent and flightctl-selinux from the edge-manager 1.2 RPM repo; enable flightctl-agent.service and mask bootc-fetch-apply-updates.timer.
- Install the device from a bootc/anaconda ISO that points at an initial OS image reference.
- Enroll the device into a flightctl/RHEM 1.2 management service.
- Confirm before update:
ls -Z /usr/bin/flightctl-agent shows flightctl_agent_exec_t.
- Change the device OS image reference in management to a different tag of the same bootc image (or any new bootc image reference).
- After bootc switch/reboot: agent fails;
ls -Z /usr/bin/flightctl-agent shows unlabeled_t.
Environment
- RHEL 9 bootc (
registry.redhat.io/rhel9/rhel-bootc:9.6)
- flightctl / edge-manager 1.2 (server + agent)
- SELinux enforcing
Expected
After deployment switch, /usr/bin/flightctl-agent retains flightctl_agent_exec_t and the agent service starts.
Related
Summary
After a bootc deployment switch triggered by an OS image update (flightctl-agent on RHEL 9 bootc, managed via Red Hat Edge Manager / flightctl),
/usr/bin/flightctl-agentends up with SELinux contextunlabeled_ton overlay. systemd cannot exec the agent under SELinux enforcing; the service restart-loops and the device stops checking in to management.On a fresh install before any deployment switch, the same binary has the correct label:
After switch + reboot:
Example AVC:
systemd:
Disabling SELinux works around it.
restoreconon/usrdoes not persist because/usris read-only on bootc; temporary fix viabootc usr-overlayis lost on reboot.Reproducibility
Reproduces when switching to the same image content with only a different tag (not caused by image content changes).
Steps to reproduce
flightctl-agentandflightctl-selinuxfrom the edge-manager 1.2 RPM repo; enableflightctl-agent.serviceand maskbootc-fetch-apply-updates.timer.ls -Z /usr/bin/flightctl-agentshowsflightctl_agent_exec_t.ls -Z /usr/bin/flightctl-agentshowsunlabeled_t.Environment
registry.redhat.io/rhel9/rhel-bootc:9.6)Expected
After deployment switch,
/usr/bin/flightctl-agentretainsflightctl_agent_exec_tand the agent service starts.Related