fedora-44-xfce based sys-net NetworkManager failed to read Configuration PermissionDenied

[secur1tree]

Qubes OS release

Qubes OS 4.3

Brief summary

A fedora-44-xfce based named disposable sys-net qube fails to start NetworkManager with configfile in /etc/NetworkManager/conf.d/.
Works in fedora-43-xfce based named disposable sys-net.

Steps to reproduce

1. In dom0: qvm-template --yes install -- fedora-44-xfce-0:4.3.0-202607140135
2. Update fedora-44-xfce using Qubes Update.
3. Create config file in /etc/NetworkManager/conf.d/
4. Shutdown template.
5. Switch template of default-dvm to fedora-44-xfce
6. Shutdown all sys-* qubes
7. Start sys-net (named disposable based on default-dvm)
8. Try interacting with the NetworkManager Tray icon.

Expected behavior

Access left-click NetworkManager functions exposed to the Tray icon.

Actual behavior

Upon left-click, NetworkManager Trayicon shows a message, that NetworkManager is not running.
Failing to start NetworkManager with systemctl (see log).
Permissions and ownership in the fedora-44-xfce template of /etc/NetworkManager/conf.d directory/files is recursively correct (checked with ls -ld /etc/NetworkManager/conf.d/ and ls -l /etc/NetworkManager/conf.d/).

Additional information

journalctl:

Jul 31 20:37:21 sys-net systemd[1]: Starting NetworkManager.service - Network Manager...
░░ Subject: A start job for unit NetworkManager.service has begun execution
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ A start job for unit NetworkManager.service has begun execution.
░░ 
░░ The job identifier is 141.
Jul 31 20:37:22 sys-net network-manager-prepare-conf-dir[683]: sed: can't read /etc/NetworkManager/system-connections/*.nmconnection:>
Jul 31 20:37:22 sys-net NetworkManager[693]: Failed to read configuration: /etc/NetworkManager/conf.d/50-macrandomize.conf: Permission denied
Jul 31 20:37:22 sys-net systemd[1]: NetworkManager.service: Main process exited, code=exited, status=1/FAILURE
░░ Subject: Unit process exited
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ An ExecStart= process belonging to unit NetworkManager.service has exited.
░░ 
░░ The process' exit code is 'exited' and its exit status is 1.
Jul 31 20:37:22 sys-net systemd[1]: NetworkManager.service: Failed with result 'exit-code'.
░░ Subject: Unit failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ 
░░ The unit NetworkManager.service has entered the 'failed' state with result 'exit-code'.
Jul 31 20:37:22 sys-net systemd[1]: Failed to start NetworkManager.service - Network Manager.
░░ Subject: A start job for unit NetworkManager.service has failed
░░ Defined-By: systemd
░░ Support: https://lists.freedesktop.org/mailman/listinfo/systemd-devel
░░ A start job for unit NetworkManager.service has begun execution.
░░ 
░░ The job identifier is 141.

[marmarek]

Create config file in /etc/NetworkManager/conf.d/

How did you created the file? Was it perhaps copied from another qube, and then moved form QubesIncoming dir?

If so, I guess SELinux (intentionally) blocks it - on top of normal file permissions, NetworkManager configs needs to have proper labels. If the file is created in NM's directory, it gets label assigned automatically, but if it's moved from elsewhere, label from that other place is preserved, and needs to be changed with restorecon command.

[ben-grande]

This issue doesn't seem related to Qubes, but Fedora+SELinux. This issue will be closed as not planned if that is the case.