Fedora 41 template

[marmarek]

Fedora 41 (https://fedorapeople.org/groups/schedule/f-41/f-41-key-tasks.html) is planned for end of October 2024. Tasks below should start after mass rebuild (planned for July/August).

Tasks:

• build all packages
• fix: The current post-upgrade hook is not able to reset the updates-available feature after successful upgrades
• update rpmfusion to final released version
• build the template
• document
• upload to testing repo
• migrate to stable repo
• announce

If any issue affects Fedora 41 specifically (build failures, things that worked fine before etc.), please add reference to this issue too.

[marmarek]

Indeed, this looks to be included only in 3007.1 release, not any 3006.x

[marmarek]

There is salt 3007.1 package for F42: https://src.fedoraproject.org/rpms/salt. I wonder if it will get published to F41 too.

[marmarek]

https://bugzilla.redhat.com/show_bug.cgi?id=2279304 suggests it will be.

[marmarek]

The qubes-app-shutdown-idle package is missing.

It's in current-testing now

[Minimalist73]

I'm not sure why I didn't see this before, but all my qubes running on Fedora 41 have memory issues. They are all stuck at the initial memory and won't bump to the maximum memory.

[user@disp2462 ~]$ free -mh
               total        used        free      shared  buff/cache   available
Mem:           445Mi       272Mi        18Mi       268Ki       165Mi       172Mi
Swap:          1.0Gi        39Mi       984Mi

I see that in the logs:

disp2462 audit[684]: AVC avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 audit[684]: AVC avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 audit[684]: AVC avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 kernel: audit: type=1400 audit(1732034995.035:110): avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 audit[684]: AVC avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 kernel: audit: type=1400 audit(1732035025.188:113): avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 audit[684]: AVC avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0
disp2462 kernel: audit: type=1400 audit(1732035301.880:126): avc:  denied  { read } for  pid=684 comm="qrexec-agent" name="meminfo-writer.pid" dev="tmpfs" ino=791 scontext=system_u:system_r:local_login_t:s0-s0:c0.c1023 tcontext=system_u:object_r:var_run_t:s0 tclass=file permissive=0

Setting SELinux globally to permissive seems to bring all my qubes back to maximum memory, so I guess that's related to those denied selinux rules.

[marmarek]

I see that in the logs:

The issue is fixed in QubesOS/updates-status#5240. I'll rebuild remaining templates once QubesOS/qubes-builder-rpm#139 is done.

[Minimalist73]

I see that in the logs:

The issue is fixed in QubesOS/updates-status#5240. I'll rebuild remaining templates once QubesOS/qubes-builder-rpm#139 is done.

Is there any manual action we can do to fix an already installed template, or do we need to reinstall from this new template?

[marmarek]

Is there any manual action we can do to fix an already installed template, or do we need to reinstall from this new template?

Try removing /.qubes-relabeled in the template and restarting it - it should fix labels on startup; it may take some time, might require increasing qrexec_timeout property.

[Minimalist73]

Is there any manual action we can do to fix an already installed template, or do we need to reinstall from this new template?

Try removing /.qubes-relabeled in the template and restarting it - it should fix labels on startup; it may take some time, might require increasing qrexec_timeout property.

I tried it a few times at first, but it didn't work for any of my templates. It seems I had to reinstall all the selinux related packages first and then proceed with relabeling for it to work. Probably some of them were half installed, no idea. Anyway, thanks!

[marmarek]

All template flavors are rebuilt now and should have the SELinux issue fixed.

[marmarek]

@andrewdavidwong no new issues are found, I think it's stable enough to announce it. Can you prepare the announcement?