calls to nsresourced are hanging mkosi

[swick]

mkosi commit the issue has been seen with

main

Used host distribution

Silverblue 44

Used target distribution

No response

Linux kernel version used

No response

CPU architectures issue was seen on

None

Unexpected behaviour you saw

For whatever reason, the varlink call to nsresourced hangs on my system. It's really confusing because there doesn't appear to be a timeout (or an unreasonably high one) which means there is not error, or warning, and no fallback to unshare. I would expect the varlink call to time out, print a warning, and transparently fall back to unshare.

Used mkosi config

mkosi output

[behrmann]

Thanks for the report. This is a bit hard to debug without having a system where nsresourced hangs.

Could you manually check what is happening? You can make the varlink call from mkosi/sandbox.py::nsresource_allocate_user_range manually or you could add a socket.settimeout to the varlink function in the same file. An strace output would also help.

[swick]

Sorry for the long delay.

If I add the timeout, the obvious thing happens:

$ mkosi -f box -- ls
Traceback (most recent call last):
  File "/var/home/swick/Projects/mkosi/mkosi/run.py", line 104, in uncaught_exception_handler
    yield
  File "/usr/lib64/python3.14/contextlib.py", line 85, in inner
    return func(*args, **kwds)
  File "/var/home/swick/Projects/mkosi/mkosi/__main__.py", line 44, in main
    run_verb(args, tools, images, resources=resources)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/home/swick/Projects/mkosi/mkosi/__init__.py", line 5054, in run_verb
    acquire_privileges(foreign=True, delegate=3)
    ~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/var/home/swick/Projects/mkosi/mkosi/sandbox.py", line 814, in acquire_privileges
    nsresource_allocate_user_range(
    ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~^
        userns_fd,
        ^^^^^^^^^^
    ...<3 lines>...
        become_root,
        ^^^^^^^^^^^^
    )
    ^
  File "/var/home/swick/Projects/mkosi/mkosi/sandbox.py", line 688, in nsresource_allocate_user_range
    varlink(
    ~~~~~~~^
        path="/run/systemd/io.systemd.NamespaceResource",
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
    ...<10 lines>...
        fds=(userns,),
        ^^^^^^^^^^^^^^
    )
    ^
  File "/var/home/swick/Projects/mkosi/mkosi/sandbox.py", line 656, in varlink
    response, reply_fds, _, _ = socket.recv_fds(sock, bufsize=10 * 1024**2, maxfds=10)
                                ~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/lib64/python3.14/socket.py", line 581, in recv_fds
    msg, ancdata, flags, addr = sock.recvmsg(bufsize,
                                ~~~~~~~~~~~~^^^^^^^^^
        _socket.CMSG_LEN(maxfds * fds.itemsize))
        ^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
TimeoutError: timed out

Also attaching the strace, but honestly, not much to see there. io.systemd.NamespaceResource just seems to misbehave, but without the timeout this is not obvious at all.

mkosi.strace.txt

[daandemeyer]

@swick Any chance you could put nsresourced in debug mode and get me some logs from there? Worst case it might be necessary to strace it. I'd really like to just fix nsresourced before we start taping over the root cause

[swick]

with SYSTEMD_LOG_LEVEL=debug

Mai 11 22:30:59 sebastian-pc systemd-nsresourcework[1724316]: varlink-6-6: Setting state idle-server
Mai 11 22:30:59 sebastian-pc systemd-nsresourcework[1724316]: varlink-6-6: Read failed: Channel number out of range
Mai 11 22:30:59 sebastian-pc systemd-nsresourcework[1724316]: varlink-6-6: Changing state idle-server → pending-disconnect

I'd really like to just fix nsresourced before we start taping over the root cause

Totally on board, but I still think having a timeout for calls which should finish immediately is better than just hanging forever because the issue becomes apparent.

[daandemeyer]

@swick Does your system have selinux enabled?

[swick]

It does. Good hunch!

time->Tue May 12 01:01:04 2026
type=AVC msg=audit(1778540464.361:1824): avc:  denied  { read } for  pid=1817310 comm="systemd-nsresou" path="user:[4026533496]" dev="nsfs" ino=4026533496 scontext=system_u:system_r:systemd_nsresourced_t:s0 tcontext=system_u:object_r:nsfs_t:s0 tclass=file permissive=0

[daandemeyer]

systemd/systemd#42043