SELinux prevents systemctl hibernate

[Alexander Zhang]

Hello,

I'm trying to enable hibernation to a swap file on Fedora 35. I've 
created a swapfile on a new BTRFS subvolume, added the resume dracut 
module, and set the kernel command line arguments. I've also added 
SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1 to the environments of 
systemd-hibernate and systemd-logind since the swap size check is 
apparently incorrect for some reason. Currently, hibernating with echo 
platform > /sys/power/disk and echo disk > /sys/power/state works, but 
doing systemctl hibernate only locks and briefly turns off the screen. I 
found these lines in the logs, which seems to indicate that SELinux is 
causing the issue:

Apr 15 23:16:14 fedora systemd[1]: Reached target Sleep.
Apr 15 23:16:14 fedora systemd[1]: Starting Hibernate...
Apr 15 23:16:14 fedora systemd-sleep[9774]: Failed to find location to 
hibernate to: Permission denied
Apr 15 23:16:14 fedora audit[9774]: AVC avc:  denied  { search } for 
pid=9774 comm="systemd-sleep" name="swap" dev="dm-0" ino=256

scontext=system_u:system_r:systemd_sleep_t:s0 
tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
Apr 15 23:16:14 fedora systemd[1]: systemd-hibernate.service: Main 
process exited, code=exited, status=1/FAILURE
Apr 15 23:16:14 fedora systemd[1]: systemd-hibernate.service: Failed 
with result 'exit-code'.
Apr 15 23:16:14 fedora systemd[1]: Failed to start Hibernate.
Apr 15 23:16:14 fedora systemd[1]: Dependency failed for System Hibernation.
Apr 15 23:16:14 fedora systemd[1]: hibernate.target: Job 
hibernate.target/start failed with result 'dependency'.
Apr 15 23:16:14 fedora audit[1]: SERVICE_START pid=1 uid=0 
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0 
msg='unit=systemd-hibernate comm="systemd" 
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'
Apr 15 23:16:14 fedora systemd-logind[1410]: Operation 'sleep' finished.
Apr 15 23:16:14 fedora systemd[1]: Stopped target Sleep.

How can I fix this?

Thanks,
Alexander Zhang

[Roberto Ragusa]

On 4/16/22 8:31 AM, Alexander Zhang wrote:
>  Hello,
>  
>  I'm trying to enable hibernation to a swap file on Fedora 35. I've created a
> swapfile on a new BTRFS subvolume, added the resume dracut module, and set the kernel
> command line arguments. I've also added SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1 to
> the environments of systemd-hibernate and systemd-logind since the swap size check is
> apparently incorrect for some reason. Currently, hibernating with echo platform >
> /sys/power/disk and echo disk > /sys/power/state works, but doing systemctl hibernate
> only locks and briefly turns off the screen. I found these lines in the logs, which seems
> to indicate that SELinux is causing the issue: 
First try would be to disable SELinux
to confirm your hypothesis.

Regards.

-- 
    Roberto Ragusa    mail at robertoragusa.it

[Alexander Zhang]

>  First try would be to disable SELinux to confirm your hypothesis.
>  However even if you fix the selinux problem i do not think this will
>  work, you need to have a swap partition for hibernate / resume to work,
>  the systemd-hibernate-resume man page makes reference to needing a
>  specific device node. 
It worked after I did `setenforce 0`, so SELinux is the
problem. I have 
my swap file inside its own BTRFS subvolume mounted at /swap and the 
SELinux context for that directory is system_u:object_r:unlabeled_t:s0. 
It looks like I need to allow systemd-sleep to search that directory. I 
think the proper way to do that is to create a new type, label /swap 
with that type, and add a policy rule that allows systemd_sleep_t to 
search that type. I don't know enough about SELinux to do that though.

Thanks,
Alex

[Joe Zeff]

On 4/17/22 22:47, Alexander Zhang wrote:
>  It worked after I did `setenforce 0`, so SELinux is the problem. I
> have 
>  my swap file inside its own BTRFS subvolume mounted at /swap and the 
>  SELinux context for that directory is system_u:object_r:unlabeled_t:s0. 
>  It looks like I need to allow systemd-sleep to search that directory. I 
>  think the proper way to do that is to create a new type, label /swap 
>  with that type, and add a policy rule that allows systemd_sleep_t to 
>  search that type. I don't know enough about SELinux to do that though. 
Easier still is to remove that partition from fstab and reformat it as a 
swap partition.

[Alexander Zhang]

>  Easier still is to remove that partition from fstab and reformat it
> as a 
>  swap partition. 
I guess I can use a swap partition, but since I use LUKS without LVM, I 
would have to make a separate LUKS volume. I wanted to use a swap file 
so that everything is in one LUKS volume.

(I forgot to reply to the list in the previous email. Sending it again 
to others can see it.)

Alex

[Samuel Sieb]

On 4/17/22 22:09, Joe Zeff wrote:
>  On 4/17/22 22:47, Alexander Zhang wrote:
> > It worked after I did `setenforce 0`, so SELinux is the problem. I 
> > have my swap file inside its own BTRFS subvolume mounted at /swap and 
> > the SELinux context for that directory is 
> > system_u:object_r:unlabeled_t:s0. It looks like I need to allow 
> > systemd-sleep to search that directory. I think the proper way to do 
> > that is to create a new type, label /swap with that type, and add a 
> > policy rule that allows systemd_sleep_t to search that type. I don't 
> > know enough about SELinux to do that though.
>  
>  Easier still is to remove that partition from fstab and reformat it as a 
>  swap partition. 
It's a btrfs subvolume, not a partition.  You can't format it.

SELinux prevents systemctl hibernate [SOLVED]

[Alexander Zhang]

>  It worked after I did `setenforce 0`, so SELinux is the problem. I
> have 
>  my swap file inside its own BTRFS subvolume mounted at /swap and the 
>  SELinux context for that directory is system_u:object_r:unlabeled_t:s0. 
>  It looks like I need to allow systemd-sleep to search that directory. I 
>  think the proper way to do that is to create a new type, label /swap 
>  with that type, and add a policy rule that allows systemd_sleep_t to 
>  search that type. I don't know enough about SELinux to do that though. 
Turns out all I needed to do is restorecon -v /swap, which relabeled 
/swap to system_u:object_r:default_t:s0 and that made hibernation work. 
Thanks for the help pointing me to the documentation.

Alex

[Ranjan Maitra]

On Fri Apr15'22 11:31:25PM, Alexander Zhang wrote:

>  Hello,
>
>  I'm trying to enable hibernation to a swap file on Fedora 35. I've created a
>  swapfile on a new BTRFS subvolume, added the resume dracut module, and set
>  the kernel command line arguments. I've also added
>  SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1 to the environments of
>  systemd-hibernate and systemd-logind since the swap size check is apparently
>  incorrect for some reason. Currently, hibernating with echo platform >
>  /sys/power/disk and echo disk > /sys/power/state works, but doing systemctl
>  hibernate only locks and briefly turns off the screen. I found these lines
>  in the logs, which seems to indicate that SELinux is causing the issue:
>
>  Apr 15 23:16:14 fedora systemd[1]: Reached target Sleep.
>  Apr 15 23:16:14 fedora systemd[1]: Starting Hibernate...
>  Apr 15 23:16:14 fedora systemd-sleep[9774]: Failed to find location to
>  hibernate to: Permission denied
>  Apr 15 23:16:14 fedora audit[9774]: AVC avc:  denied  { search } for
>  pid=9774 comm="systemd-sleep" name="swap" dev="dm-0"
> ino=256
>  scontext=system_u:system_r:systemd_sleep_t:s0
>  tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
>  Apr 15 23:16:14 fedora systemd[1]: systemd-hibernate.service: Main process
>  exited, code=exited, status=1/FAILURE
>  Apr 15 23:16:14 fedora systemd[1]: systemd-hibernate.service: Failed with
>  result 'exit-code'.
>  Apr 15 23:16:14 fedora systemd[1]: Failed to start Hibernate.
>  Apr 15 23:16:14 fedora systemd[1]: Dependency failed for System Hibernation.
>  Apr 15 23:16:14 fedora systemd[1]: hibernate.target: Job
>  hibernate.target/start failed with result 'dependency'.
>  Apr 15 23:16:14 fedora audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295
>  ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-hibernate
>  comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?
> terminal=?
>  res=failed'
>  Apr 15 23:16:14 fedora systemd-logind[1410]: Operation 'sleep' finished.
>  Apr 15 23:16:14 fedora systemd[1]: Stopped target Sleep.
>
>  How can I fix this?
>
>  Thanks,
>  Alexander Zhang 
Hello Alexander,

It would be helpful to know more about your system, etc. Also, a listing of the exact
steps that you did to enable it?

It would be nice to have the hibernate issue settled, of course, but for some reason, it
persists.

Ranjan

[Steven Taylor]

Hi,

From the error message you are getting the it looks like the swapfile or
the directory it is sat in has the wrong label.  you can use some of the
policy tools to fix this by setting the correct context... the RHEL
guide is good source for this
https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/7/...

However even if you fix the selinux problem i do not think this will
work, you need to have a swap partition for hibernate / resume to work,
the systemd-hibernate-resume man page makes reference to needing a
specific device node.

Kind Regards,

Steve


Alexander Zhang <zhangalexy(a)gmail.com&gt; writes:

>  Hello,
>
>  I'm trying to enable hibernation to a swap file on Fedora 35. I've created a
>  swapfile on a new BTRFS subvolume, added the resume dracut module, and set the
>  kernel command line arguments. I've also added
>  SYSTEMD_BYPASS_HIBERNATION_MEMORY_CHECK=1 to the environments of
>  systemd-hibernate and systemd-logind since the swap size check is apparently
>  incorrect for some reason. Currently, hibernating with echo platform >
>  /sys/power/disk and echo disk > /sys/power/state works, but doing systemctl
>  hibernate only locks and briefly turns off the screen. I found these lines in
>  the logs, which seems to indicate that SELinux is causing the issue:
>
>  Apr 15 23:16:14 fedora systemd[1]: Reached target Sleep.
>  Apr 15 23:16:14 fedora systemd[1]: Starting Hibernate...
>  Apr 15 23:16:14 fedora systemd-sleep[9774]: Failed to find location to hibernate
>  to: Permission denied
>  Apr 15 23:16:14 fedora audit[9774]: AVC avc:  denied  { search } for pid=9774
>  comm="systemd-sleep" name="swap" dev="dm-0" ino=256
>  scontext=system_u:system_r:systemd_sleep_t:s0
>  tcontext=system_u:object_r:unlabeled_t:s0 tclass=dir permissive=0
>  Apr 15 23:16:14 fedora systemd[1]: systemd-hibernate.service: Main process
>  exited, code=exited, status=1/FAILURE
>  Apr 15 23:16:14 fedora systemd[1]: systemd-hibernate.service: Failed with result
>  'exit-code'.
>  Apr 15 23:16:14 fedora systemd[1]: Failed to start Hibernate.
>  Apr 15 23:16:14 fedora systemd[1]: Dependency failed for System Hibernation.
>  Apr 15 23:16:14 fedora systemd[1]: hibernate.target: Job hibernate.target/start
>  failed with result 'dependency'.
>  Apr 15 23:16:14 fedora audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295
>  ses=4294967295 subj=system_u:system_r:init_t:s0 msg='unit=systemd-hibernate
>  comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=?
> terminal=?
>  res=failed'
>  Apr 15 23:16:14 fedora systemd-logind[1410]: Operation 'sleep' finished.
>  Apr 15 23:16:14 fedora systemd[1]: Stopped target Sleep.
>
>  How can I fix this?
>
>  Thanks,
>  Alexander Zhang
>  _______________________________________________
>  users mailing list -- users(a)lists.fedoraproject.org
>  To unsubscribe send an email to users-leave(a)lists.fedoraproject.org
>  Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
>  List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
>  List Archives:
> https://lists.fedoraproject.org/archives/list/[e-mail]
>  Do not reply to spam on the list, report it: https://pagure.io/fedora-infrastructure