1

I'm on Fedora 27 and experience problems with updating the packages by dnf update. The problem is exactly as described here: https://superuser.com/q/1005740/683161

I tried to delete symlink under /usr/lib, but can't, even under root:

vplagov@thinkpad:~ $ sudo rm -f /usr/lib/cpp 
rm: cannot remove '/usr/lib/cpp': Operation not permitted
...
vplagov@thinkpad:~ $ file /usr/lib/cpp 
/usr/lib/cpp: symbolic link to ../bin/cpp
...
vplagov@thinkpad:~ $ ls -al /usr/lib/cpp 
lrwxrwxrwx. 1 root root 10 Sep 15 15:01 /usr/lib/cpp -> ../bin/cpp

I see that file has a dot at the end of file permissions. By googling I found commands to remove the SELinux context or ACL (I don't know what are those). But still can't fix it:

vplagov@thinkpad:~ $ sudo setfacl -b /usr/lib/cpp
...
vplagov@thinkpad:~ $ ls -al /usr/lib/cpp 
lrwxrwxrwx. 1 root root 10 Sep 15 15:01 /usr/lib/cpp -> ../bin/cpp
... 
vplagov@thinkpad:~ $ sudo rm -f /usr/lib/cpp 
rm: cannot remove '/usr/lib/cpp': Operation not permitted
...
vplagov@thinkpad:~ $ sudo setfattr -x security.selinux /usr/lib/cpp 
setfattr: /usr/lib/cpp: Permission denied

Is there a "healthy" option to fix this?

  • Are there any related log entries in audit log (/var/log/audit/audit.log)? – sebasth Mar 9 '18 at 10:09
  • Yes, there are. When I run sudo setfattr -x security.selinux /usr/lib/cpp, following logs to the audit.log: justpaste.it/1i2gc But I can't quite understand the output of this log. – Vitalii Plagov Mar 9 '18 at 17:51
1

Reboot with "emergency shell".

I think the fastest way could be to reboot the computer with SELinux enforcing mode disabled into an emergency shell. Just pass "rd.break enforcing=0" to your kernel boot command line (append to the line starting with "linux " in you GRUB boot menu, then Ctrl+x to boot). After booting, remount the / partition read-write

mount –o remount,rw /sysroot

In this shell you can just cd into /sysroot/usr/lib/ and/or rm your symbolic link.

To exit, type

reboot
  • Thank you for your answer. I didn't know about this before. I did this, I deleted the /usr/bin/cpp symlink. Rebooted back in Fedora as usual, checked that that symlink doesn't exist and run dnf upgrade again, but still the same error... Don't know what is possible to do with it now, except reinstalling the OS. – Vitalii Plagov Mar 30 '18 at 16:10
  • OK, so the method did succeed removing the link, but the upgrade still failed? – Ned64 Apr 1 '18 at 14:06
  • yes, exactly as you described. – Vitalii Plagov Apr 2 '18 at 19:41
1

You can try to relabel the files on your machine by running fixfiles onboot and then rebooting

You might also want to check in which context your current user is running with id -Z, on default installation, your user should run in unconfined_t.

ls-z shows the SeLinux labels (compare them to a „good“ system).

setenforce 0 will disable SeLinux temporary, though you are better off fixing the root cause (broken SeLinux labels).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.