From 8e729d511eb9cb53e30d3a32e648376c7cfe0318 Mon Sep 17 00:00:00 2001 From: Jonathan Lebon Date: Tue, 12 Mar 2019 15:23:25 -0400 Subject: [PATCH] units: update catalog after systemd-tmpfiles runs `systemd-journal-catalog-update.service` writes to `/var`. However, it's not explicitly ordered wrt `systemd-tmpfiles-setup.service`, which means that it may run before or after. This is an issue for Fedora CoreOS, which uses Ignition. We want to be able to prepare `/var` on first boot from the initrd, where the SELinux policy is not loaded yet. This means that the hierarchy under `/var` is not correctly labeled. We add a `Z /var - - -` tmpfiles entry so that it gets relabeled once `/var` gets mounted post-switchroot. So any service that tries to access `/var` before `systemd-tmpfiles` relabels it is likely to hit `EACCES`. Fix this by simply ordering `systemd-journal-catalog-update.service` after `systemd-tmpfiles-setup.service`. This is also clearer since the tmpfiles entries are the canonical source of how `/var` should be populated. For more context on this, see: https://github.com/coreos/ignition/issues/635#issuecomment-446620297 --- units/systemd-journal-catalog-update.service.in | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/units/systemd-journal-catalog-update.service.in b/units/systemd-journal-catalog-update.service.in index 6a7bf006cd..18b2739ffa 100644 --- a/units/systemd-journal-catalog-update.service.in +++ b/units/systemd-journal-catalog-update.service.in @@ -12,7 +12,7 @@ Description=Rebuild Journal Catalog Documentation=man:systemd-journald.service(8) man:journald.conf(5) DefaultDependencies=no Conflicts=shutdown.target -After=local-fs.target +After=local-fs.target systemd-tmpfiles-setup.service Before=sysinit.target shutdown.target systemd-update-done.service ConditionNeedsUpdate=/var