Error on update: Unencapsulating base - Permission denied

[DiogoASTeixeira]

Hello everyone!

When running ujust update, I get the following logs and error:

note: automatic updates (stage) are enabled
Pulling manifest: ostree-image-signed:docker://ghcr.io/ublue-os/aurora:stable
Importing: ostree-image-signed:docker://ghcr.io/ublue-os/aurora:stable (digest: sha256:562db764497cabb0b6a618776429be072d22525190b3b3bffd3030b67f4c5874)
ostree chunk layers already present: 8
ostree chunk layers needed: 66 (3.4 GB)
[0/66] Fetching ostree chunk 1dda6670e32ac515d48 (392.9 MB)... done
error: Importing: Unencapsulating base: Layer sha256:1dda6670e32ac515d48aa700fb6d9b8a93f3ca47267258e1ad418cdc01fc8f82: tmpdir cleanup: Removing 69edac2d-7d63-45c9-9c89-d1c9882e1611: Removing 69edac2d-7d63-45c9-9c89-d1c9882e1611: unlinkat(oidc_child): Permission denied

I have tried using sudo as well, same result.

Does anyone have any idea? Thank you in advance!

[inffy]

rpm-ostree status please

[DiogoASTeixeira]

State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: inactive
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/aurora:stable
                   Digest: sha256:1c05db178a621840c78128586fd27a5ab2ef57db77f8e85f4238bdc71f463c4d
                  Version: 43.20260224.1 (2026-02-24T07:24:45Z)

  ostree-image-signed:docker://ghcr.io/ublue-os/aurora:stable
                   Digest: sha256:6fabb64a7796c39f5dd5befb73f75324bc8f3dd7d8386a4273bdd27a44ebb1ad
                  Version: 43.20260203 (2026-02-03T02:04:00Z)

Thank you for the quick reply!

[manfredlotz]

One other idea. Please check if there are SELinux errors.

journalctl -t setroubleshoot

[DiogoASTeixeira]

Just a line
-- No entries --

[manfredlotz]

Ok. Good to know that on this front is nothing bad.

[DiogoASTeixeira]

1. It is a read-only file system, files can't be removed like this.

time->Fri Apr 17 17:53:51 2026
type=AVC msg=audit(1776444831.744:983): avc:  denied  { getattr } for  pid=14615 comm="getcap" name="oidc_child" dev="erofs" ino=63783 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0


time->Fri Apr 17 17:54:01 2026
type=AVC msg=audit(1776444841.329:986): avc:  denied  { getattr } for  pid=14642 comm="lsattr" name="oidc_child" dev="erofs" ino=63783 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0


time->Fri Apr 17 17:54:08 2026
type=AVC msg=audit(1776444848.380:1026): avc:  denied  { getattr } for  pid=14706 comm="lsattr" name="oidc_child" dev="erofs" ino=63783 scontext=system_u:system_r:kernel_t:s0 tcontext=system_u:object_r:sssd_mfa_exec_t:s0 tclass=file permissive=0

3. No differences found
4. /usr/libexec/sssd/oidc_child (Permission denied)

[renner0e]

This looks like fedora-selinux/selinux-policy#3081 and #1809 which got worked around by #1811 so yeah temporarily setting selinux to permissive sudo setenforce 0 and then running the update again sudo bootc upgrade might fix it.

I do not know why you are running into this explicitly as it has worked for all of my machines and for many other people without any manual intervention whatsoever.

[DiogoASTeixeira]

I do not know why this was marked as low quality: #2065 (reply in thread)

But it had the answer

sudo setenforce 0
ujust update
sudo setenforce 1

fixed the issue, and now I can update without settting SELinux to permissive again.

Thank you everyone!