homectl fails to create user when selinux is in enforcing mode

[thmichel]

Describe the bug

I wanted to use systemd-homed to manage home directories. When trying to create a user, it fails with the error:
Operation on home test failed: Remote peer disconnected
Setting selinx to permissive fixes the error.
Even after creation, if selinux is set to enforcing again, the user cannot logon.

What did you expect to happen?

I expected the user and home file to be created with selinux in enforcing mode

Output of bootc status

Booted ostree
           Commit: bbd7bdc3a3d82791fef291bf76e6eefa0baf5346d913725f1ec7f2f0bddef7b3

Rollback ostree
           Commit: 9c0eb97ab4134888b3d7df549904b333d552507f1f832c557e156cb5c98f0f32

Output of groups

Extra information or context

No response

[repires]

AI Generated:

This is a known issue: SELinux enforcing mode blocks systemd-homed operations, causing homectl to fail with "Remote peer disconnected" and preventing user logins. Setting SELinux to permissive mode allows user creation, but enforcing mode triggers policy denials. Bluefin does not ship custom SELinux policies for systemd-homed and relies on upstream integration—there are no overlays or scripts in the repo to address this directly.

The root cause is an upstream SELinux policy gap for systemd-homed. The recommended workaround is to keep SELinux in permissive mode when managing users with homectl. For a more permanent solution, you can collect SELinux AVC denials (using ausearch or sealert), then generate a custom policy module with audit2allow to permit the required actions. This is the standard SELinux troubleshooting approach for new services or features that lack policy coverage.

If you need to restore access for other services, relabeling files with restorecon or adjusting file contexts with semanage fcontext can resolve some permission issues, but for systemd-homed, a custom policy module is likely required. Any upstream fix or policy module for systemd-homed would benefit all Fedora-based systems, not just Bluefin. Until then, permissive mode or custom policy modules are the only workarounds.

[repires]

@thmichel Hi are you still having the same issue on the lastest image?

What's the output of rpm-ostree status?

[thmichel]

Seems fixed now. Just created a user using homectl successfully and was able to log in.

Her's the requested output:
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: inactive
Deployments:
● ostree-image-signed:docker://ghcr.io/ublue-os/bazzite-dx-nvidia-gnome:stable
Digest: sha256:29268f2e643849c772d68aab8d7eec103f8bd00c6ec7cd6a225592d847a24add
Version: 43.20260126 (2026-01-26T05:40:11Z)
LayeredPackages: java-latest-openjdk wireshark
LocalPackages: webex-45.6.2.32823-1.x86_64

ostree-image-signed:docker://ghcr.io/ublue-os/bazzite-dx-nvidia-gnome:stable
Digest: sha256:803d5f94e7a4bae6873ccfcba429e59bc1c88625d286fc5f2181a0d665ff127e
Version: 43.20260120.1 (2026-01-20T06:31:51Z)
LayeredPackages: java-latest-openjdk wireshark
LocalPackages: webex-45.6.2.32823-1.x86_64