fedora-infrastructure

#9036 FAS2 is broken on various IAD2 hosts
Closed: Fixed by kevin. Opened by smooge.

Closed: Fixed
Reopen Issue

Describe what you would like us to do:

FAS is unable to do ssh key runs on various hosts giving the following error:

setxattr failed: /home/fedora/mohanboddu/.ssh: Operation not permitted
setxattr failed: /home/fedora/ralph/.ssh: Operation not permitted
setxattr failed: /home/fedora/kevin/.ssh: Operation not permitted
setxattr failed: /home/fedora/pingou/.ssh: Operation not permitted
setxattr failed: /home/fedora/pbrobinson/.ssh: Operation not permitted
setxattr failed: /home/fedora/tflink/.ssh: Operation not permitted
setxattr failed: /home/fedora/jstanley/.ssh: Operation not permitted
setxattr failed: /home/fedora/mizdebsk/.ssh: Operation not permitted
setxattr failed: /home/fedora/codeblock/.ssh: Operation not permitted
setxattr failed: /home/fedora/smooge/.ssh: Operation not permitted
setxattr failed: /home/fedora/cverna/.ssh: Operation not permitted
setxattr failed: /home/fedora/puiterwijk/.ssh: Operation not permitted
setxattr failed: /home/fedora/sharkcz/.ssh: Operation not permitted
setxattr failed: /home/fedora/limb/.ssh: Operation not permitted
setxattr failed: /home/fedora/kellin/.ssh: Operation not permitted
setxattr failed: /home/fedora/till/.ssh: Operation not permitted
setxattr failed: /home/fedora/dustymabe/.ssh: Operation not permitted
setxattr failed: /home/fedora/humaton/.ssh: Operation not permitted
setxattr failed: /home/fedora/mikem/.ssh: Operation not permitted
setxattr failed: /home/fedora/lsedlar/.ssh: Operation not permitted
setxattr failed: /home/fedora/parasense/.ssh: Operation not permitted
setxattr failed: /home/fedora/maxamillion/.ssh: Operation not permitted

This generates a couple hundred emails every hour or so as fasClient -if 'fails'.

When do you need this to be done by? (YYYY/MM/DD)

Note that this seems to be fedora 32 and rhel8 instances, so something with newer selinux?

Metadata Update from @kevin:
- Issue priority set to: Waiting on Assignee (was: Needs Review)
- Issue tagged with: authentication, groomed, medium-gain, medium-trouble

Metadata Update from @pingou:
- Issue assigned to pingou

So the error is coming from selinux itself: https://github.com/SELinuxProject/selinux/blob/master/libselinux/src/selinux_restorecon.c#L1090-L1092 and we can't catch this in python, it's directly printed in stderr.

It seems related to the fact that we drop root privileges to become the user's uid/gid to create the .ssh folder and its content. However, I am not able to reproduce this with a simple script that sets the euid, egid and groups to a certain user and then call selinux.restorecon().

I have tested that moving around the call to selinux.restorecon() in the code so it's executed under root privileges no longer triggers the error, so we could just do this, but I'm not able to explain why it is no longer working currently (and just for the fun, doing setenforce 0 does not change anything).

So we have a potential fix, but not the root cause

I've tested the patched fasClient and it seemed to work, so I rolled it out to all the fedora 32 hosts.

I think we can just close this now unless we see it pop up again...

many thanks for looking into this @pingou !

Metadata Update from @kevin:
- Issue close_status updated to: Fixed
- Issue status updated to: Closed (was: Open)
Metadata

authentication medium-gain medium-trouble

None
None
Normal
Static archive. pagure.io was sunset in 2026; this is a read-only snapshot.
Red Hat Logo

Fedora is sponsored by Red Hat. Learn more about the relationship between Red Hat and Fedora »

© Red Hat, Inc. and others.