Arch Linux User Repository

sorin-mihai: I have updated the package. For your information, when you update your system and a dependency of systemd gets updated, you need to check whether systemctl still works and whether "ldd /usr/lib/systemd/systemd" does not report any library with "=> not found". If there are issues there, rebuilding systemd-selinux should be enough in order to fix the broken library dependencies, like any package in the AUR that depends on libraries that are upgraded to a different ".so version".

In case it helps someone, I am using a script that works like Gentoo's revdep-rebuild tool in order to detect such breakage on my system. I have published it on https://github.com/fishilico/home-files/blob/master/bin/find-broken-libdep

Just marked the package as out-of date

• core/systemd is now 242.32-3
• when trying to update iptables to 1:1.8.3-1 I got this error: /usr/bin/systemctl: error while loading shared libraries: libip4tc.so.0: cannot open shared object file: No such file or directory

As a result the rebuilt initramfs is unbootable. The only workaround I used so far is to keep iptables at 1:1.8.2-1 blacklisting it from upgrade in /etc/pacman.conf

Anyone that needs to recover from an unbootable system related to this, can get the previous iptables from https://archive.org/download/archlinux_pkg_iptables/iptables-1\:1.8.2-1-x86_64.pkg.tar.xz and install it from a live usb in a mounted chroot. Usuall recovery I'd say, while in chroot just install the package and rebuild the initramfs with mkinitcpio

Arch's systemd has already backported 2 patches to fix https://bugs.archlinux.org/task/62483 and I've submitted a pull request for you to do the same. Thanks! https://github.com/archlinuxhardened/selinux/pull/22

@kvnbai

journalctl --vacuum-size=100M

may fix the problem.

@kvnbai Does the issue also exist when you build the offical systemd package from source? This does not looks like something specific to modifications related to SELinux.

@yar: the last time I tried to use makechrootpkg, it required root privileged. Which is why I tried to use it with fakeroot+fakechroot and proot (https://github.com/fishilico/home-files/blob/master/bin/makecleanpkg + https://github.com/archlinuxhardened/selinux/blob/master/build_cleanpkg.sh). Unfortunately it does not work with systemd package, cf. https://github.com/archlinuxhardened/selinux/blob/master/build_cleanpkg.sh#L137-L147 For information, this is the major bug preventing me to set up a "user package repository" with SELinux packages which would be compiled by an Continuous Integration system every time a package is built.

I highly recommend building with makechrootpkg https://wiki.archlinux.org/index.php/DeveloperWiki:Building_in_a_clean_chroot

@IooNag

The build only fails when using 1 CPU (using VM), giving my VM atleast 2 CPUs solves the issue. I'm not sure if this is a large issue, so I'll just leave a comment here:

Is your system up-to-date? Yes tested on the newest stable manjaro-i3 release. I updated the system before following the wiki.

Are you using an x86-64 CPU? Yes

Did you try building systemd-selinux in a freshly installed system? Yes

Does /home/test/.cache/yay/systemd-selinux/src/build/test-journal-flush exist, and if yes, does it show the same error when you run it directly? Yes it exists and it shows the same error when executed, the files that the script wish to create are also created in /tmp

Is SELinux enabled on your system? SELinux is disabled

Prep before isntalling SELinux: Removed mlocate because the AUR helper I use can only remove findutils while installing findutils-selinux

@kvnbai: the package builds fine on my (up to date) system. Could you please give more details about your issue on https://github.com/archlinuxhardened/selinux/issues , which would allow me to reproduce the failure? Here are some questions which help in a bug report: Is your system up-to-date? Are you using an x86-64 CPU? Did you try building systemd-selinux in a freshly installed system? Does /home/test/.cache/yay/systemd-selinux/src/build/test-journal-flush exist, and if yes, does it show the same error when you run it directly? Is SELinux enabled on your system? If yes, in which mode and policy (cf. the output of "sestatus -v")? Does test-journal-flush trigger AVC denials in audit.log?

Cant build the package

...
228/318 test-journal-stream OK 0.02 s
229/318 test-journal-flush FAIL 0.28 s (killed by signal 6 SIGABRT)
230/318 test-journal-init OK 0.12 s ...
Full log written to /home/test/selinux/systemd-selinux/src/build/meson-logs/testlog.txt
==> ERROR: A failure occurred in check().
Aborting...

Logfile:

229/318 test-journal-flush FAIL 0.32 s (killed by signal 6 SIGABRT)
--- command ---
PATH='/home/test/.cache/yay/systemd-selinux/src/build:/usr/local/bin:/usr/bin:/bin:/usr/local/sbin:/usr/bin/site_perl:/usr/bin/vendor_perl:/usr/bin/core_perl' SYSTEMD_LANGUAGE_FALLBACK_MAP='/home/test/.cache/yay/systemd-selinux/src/systemd-stable/src/locale/language-fallback-map' SYSTEMD_KBD_MODEL_MAP='/home/test/.cache/yay/systemd-selinux/src/systemd-stable/src/locale/kbd-model-map' /home/test/.cache/yay/systemd-selinux/src/build/test-journal-flush
--- stderr ---
Assertion 'r >= 0' failed at ../systemd-stable/src/journal/test-journal-flush.c:43, function main(). Aborting. Aborted (core dumped)

Thank you. It works now.