dbus-broker Error: launcher_run_child Permission denied During Dracut Boot

Introduction

During two-stage dracut boot on Warewulf, dbus-broker may crash in the initramfs with ERROR launcher_run_child @ ../src/launch/launcher.c +325: Permission denied. When that happens, NetworkManager never comes up and the node cannot reach the Warewulf server to download its image.

The root cause is incorrect permissions on /etc/machine-id inside the initramfs. The dracut version shipped with Rocky 9.4 does not set the correct permissions on this file.

Problem

Nodes fail to two-stage dracut boot. D-Bus crashes repeatedly, NetworkManager cannot start without D-Bus, and the wwinit module fails to download stages from the Warewulf server.

Symptoms

Console output shows D-Bus and NetworkManager failing in a loop:

[FAILED] Failed to start D-Bus System Message Bus.
[FAILED] Failed to start nm-initrd.service.
[DEPEND] Dependency failed for nm-wait-online-initrd.service.

Followed by the wwinit stage failures:

dracut-pre-mount: gzip: stdin: unexpected end of file
dracut-pre-mount: cpio: premature end of archive
dracut: FATAL: Unable to load stage: system

Adding rd.shell to the kernel arguments drops into the dracut emergency shell on failure. From there, journalctl -u dbus-broker.service --no-pager shows the actual error:

ERROR launcher_run_child @ ../src/launch/launcher.c +325: Permission denied
ERROR service_add @ ../src/launch/service.c +921: Transport endpoint is not connected
Exiting due to fatal error: -107

And ls -la /etc/machine-id shows -rw-r----- (0640) instead of -r--r--r-- (0444).

Resolution

Create a small dracut module in the image to reset the file permissions during initramfs generation:

wwctl image shell <image>

mkdir -p /usr/lib/dracut/modules.d/99fix-machineid
cat > /usr/lib/dracut/modules.d/99fix-machineid/module-setup.sh << 'EOF'
#!/bin/bash
check() { return 0; }
depends() { return 0; }
install() {
    chmod 444 "$initdir/etc/machine-id"
}
EOF
chmod 755 /usr/lib/dracut/modules.d/99fix-machineid/module-setup.sh

Rebuild the initramfs and verify:

dracut --force --no-hostonly --add "wwinit" --regenerate-all
lsinitrd /boot/initramfs-*.img | grep machine-id

The output should show -r--r--r-- (0444). Exit the shell and reboot the node.

Root Cause

In affected builds, dracut creates /etc/machine-id in the initramfs with permissions of 0640 instead of a world-readable mode. dbus-broker then fails when it tries to read that file, which prevents D-Bus and NetworkManager from starting in the initramfs.

The custom 99fix-machineid module runs last during the dracut build and sets 0444 regardless of what earlier modules did.

Notes

• The /etc/machine-id file in Warewulf images should be empty (zero bytes). Use truncate -s0 /etc/machine-id. Do not delete the file, as that triggers systemd first-boot semantics. See the Warewulf two-stage boot documentation.

References & related articles

Enabling Two-Stage Booting with Dracut on an Existing Warewulf Image Upstream dracut PR #2139 - dbus.socket activation fix