freeradius-3.2.8-1.el9 fails to start
I have a Rocky Linux release 9.6 system running with: freeradius-3.2.7-1.el9.x86_64 freeradius-mysql-3.2.7-1.el9.x86_64 freeradius-utils-3.2.7-1.el9.x86_64 I am using the networkradius repo: [networkradius] name=NetworkRADIUS-$releasever baseurl=http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ enabled=1 gpgcheck=1 gpgkey=https://packages.networkradius.com/pgp/packages%40networkradius.com After doing a DNF update to my system today results in radiusd failing to start. /var/log/messages has what looks like some relevant error messages: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Failed with result 'exit-code'. If I downgrade back to 3.2.7-1 the service starts as usual. Am I missing a step in the upgrade or something? Thanks, Dan Oachs
We're experiencing a very similar issue with our Alma 9 machines after the update. FreeRADIUS works fine when started in debug mode, but the service will not start. Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: PARTICULAR PURPOSE Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: You may redistribute copies of FreeRADIUS under the terms of the Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: GNU General Public License Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: For more information about these matters, see the file named COPYRIGHT Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: FreeRADIUS is developed, maintained, and supported by InkBridge Networks. Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: For commercial support, please email sales@inkbridgenetworks.com Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: https://inkbridgenetworks.com/ Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: Starting - reading configuration files ... Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: /etc/raddb/proxy.conf[31]: Invalid regular expression: Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: /etc/raddb/proxy.conf[31]: .+$ Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: /etc/raddb/proxy.conf[31]: ^ Pattern JIT failed: no more memory Aug 22 11:48:58 NZWLGRA1 systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE I temporarily removed all regex expressions in my proxy.conf file (error referenced above) and tried starting the service, but then got the same policyd/filter error that Dan recorded. On Fri, 22 Aug 2025 at 03:26, Dan Oachs via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I have a Rocky Linux release 9.6 system running with: freeradius-3.2.7-1.el9.x86_64 freeradius-mysql-3.2.7-1.el9.x86_64 freeradius-utils-3.2.7-1.el9.x86_64
I am using the networkradius repo: [networkradius] name=NetworkRADIUS-$releasever baseurl=http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ enabled=1 gpgcheck=1 gpgkey=https://packages.networkradius.com/pgp/packages%40networkradius.com
After doing a DNF update to my system today results in radiusd failing to start.
/var/log/messages has what looks like some relevant error messages: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Failed with result 'exit-code'.
If I downgrade back to 3.2.7-1 the service starts as usual.
Am I missing a step in the upgrade or something?
Thanks, Dan Oachs - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
We are experiencing the same issue. We even tested on brand new RHEL 9 VM with no custom config (kept at default): bash-5.1# journalctl -u radiusd [output cut] Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24832]: Compiling Post-Auth-Type REJECT for attr Post-Auth-Type Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24832]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24832]: /etc/raddb/policy.d/filter[31]: Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com radiusd[24832]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: radiusd.service: Failed with result 'exit-code'. Aug 22 00:05:08 vm-68a7af574aa13c7161eb42f4.us-east-1.compute.is.apple.com systemd[1]: Failed to start FreeRADIUS multi-protocol policy server. On Thu, Aug 21, 2025 at 4:56 PM George Benjin <george.benjin@gmail.com> wrote:
We're experiencing a very similar issue with our Alma 9 machines after the update.
FreeRADIUS works fine when started in debug mode, but the service will not start.
Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: There is NO warranty; not even for MERCHANTABILITY or FITNESS FOR A Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: PARTICULAR PURPOSE Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: You may redistribute copies of FreeRADIUS under the terms of the Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: GNU General Public License Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: For more information about these matters, see the file named COPYRIGHT Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: FreeRADIUS is developed, maintained, and supported by InkBridge Networks. Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: For commercial support, please email sales@inkbridgenetworks.com Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: https://inkbridgenetworks.com/ Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: Starting - reading configuration files ... Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: /etc/raddb/proxy.conf[31]: Invalid regular expression: Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: /etc/raddb/proxy.conf[31]: .+$ Aug 22 11:48:58 NZWLGRA1 radiusd[109867]: /etc/raddb/proxy.conf[31]: ^ Pattern JIT failed: no more memory Aug 22 11:48:58 NZWLGRA1 systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE
I temporarily removed all regex expressions in my proxy.conf file (error referenced above) and tried starting the service, but then got the same policyd/filter error that Dan recorded.
On Fri, 22 Aug 2025 at 03:26, Dan Oachs via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I have a Rocky Linux release 9.6 system running with: freeradius-3.2.7-1.el9.x86_64 freeradius-mysql-3.2.7-1.el9.x86_64 freeradius-utils-3.2.7-1.el9.x86_64
I am using the networkradius repo: [networkradius] name=NetworkRADIUS-$releasever baseurl=
enabled=1 gpgcheck=1 gpgkey= https://packages.networkradius.com/pgp/packages%40networkradius.com
After doing a DNF update to my system today results in radiusd failing to start.
/var/log/messages has what looks like some relevant error messages: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Invalid regular expression: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: Aug 21 10:14:12 farmhand radiusd[2668739]: /etc/raddb/policy.d/filter[31]: ^ Pattern JIT failed: no more memory Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Control process exited, code=exited, status=1/FAILURE Aug 21 10:14:12 farmhand systemd[1]: radiusd.service: Failed with result 'exit-code'.
If I downgrade back to 3.2.7-1 the service starts as usual.
Am I missing a step in the upgrade or something?
Thanks, Dan Oachs - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
http://packages.networkradius.com/freeradius-3.2/rocky/$releasever/ - List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
-- This electronic mail transmission may contain information that is protected by privacy laws. It is not intended for transmission to, or receipt by, any unauthorized persons.
On 22/08/2025 01:05, Cyrus Humphreville wrote:
We are experiencing the same issue. We even tested on brand new RHEL 9 VM with no custom config (kept at default):
OK. We've not seen anything in our tests and 3.2.8 starts fine for me on Rocky 9, but looks like there's an issue somewhere. -- Matthew
I can confirm this problem on AlmaLinux 9. It seems to be related to the use of pcre2 which wasn’t used before. The server starts up from an interactive shell. It fails when started from systemd with the first regex it comes across. $ dnf -y downgrade freeradius goes back to 3.2.7 and starts up just fine for now. Cheers.
On 22. Aug 2025, at 11:36, Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
On 22/08/2025 01:05, Cyrus Humphreville wrote:
We are experiencing the same issue. We even tested on brand new RHEL 9 VM with no custom config (kept at default):
OK. We've not seen anything in our tests and 3.2.8 starts fine for me on Rocky 9, but looks like there's an issue somewhere.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
I can confirm this problem on AlmaLinux 9. It seems to be related to the use of pcre2 which wasn’t used before. The server starts up from an interactive shell. It fails when started from systemd with the first regex it comes across. $ dnf -y downgrade freeradius goes back to 3.2.7 and starts up just fine for now. Cheers.
On 22. Aug 2025, at 11:36, Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
On 22/08/2025 01:05, Cyrus Humphreville wrote:
We are experiencing the same issue. We even tested on brand new RHEL 9 VM with no custom config (kept at default):
OK. We've not seen anything in our tests and 3.2.8 starts fine for me on Rocky 9, but looks like there's an issue somewhere.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On Aug 22, 2025, at 6:57 AM, mohair.scarves.0i--- via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I can confirm this problem on AlmaLinux 9. It seems to be related to the use of pcre2 which wasn’t used before.
The server starts up from an interactive shell. It fails when started from systemd with the first regex it comes across.
Well, that's unfriendly. I would suspect that it's related to the PCRE JIT. i.e. if you run it as root, the JIT can get executable memory. When you run it as a non-root user, the OS won't give the JIT executable memory. Perhaps try 3.2.8 from an interactive shell, but as the "radiusd" or "freeradius" user. If you get the same memory error, then that's the problem. We can likely patch the code, and issue RPMs of 3.2.8-1. I don't think there's a need for an official 3.2.9 yet. Alan DeKok.
On 22/08/2025 12:08, Alan DeKok via Freeradius-Users wrote:
On Aug 22, 2025, at 6:57 AM, mohair.scarves.0i--- via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I can confirm this problem on AlmaLinux 9. It seems to be related to the use of pcre2 which wasn’t used before.
Well, that's unfriendly. I would suspect that it's related to the PCRE JIT. i.e. if you run it as root, the JIT can get executable memory. When you run it as a non-root user, the OS won't give the JIT executable memory.
Yes. Looks like PCRE2 with JIT needs selinux policies to work - disabling selinux will likely also fix the issue. We had to put PCRE2 in because Rocky10 and Debian13 don't include PCRE1 any more. But the configure script then automatically picked that for the existing OSes as well.
We can likely patch the code, and issue RPMs of 3.2.8-1. I don't think there's a need for an official 3.2.9 yet.
Yeah, I'm working on 3.2.8-2 packages to flip it back to PCRE1. Thanks Nick for debugging this one in detail. -- Matthew
O.K. I have checked the audit logs and there is nothing in there. But you are right, setting selinux to permissive allows the server to start. Thus, I have disabled the dontaudit rules and checked the audit log again and then you can easily find the solution: # semodule -DB # ausearch -m avc | audit2allow … #============= radiusd_t ============== #!!!! This avc has a dontaudit rule in the current policy allow radiusd_t self:capability net_admin; #!!!! This avc can be allowed using the boolean 'radius_use_jit' allow radiusd_t self:process execmem; … The selinux policy seems already to be prepared for this issue. Thus # setsebool -P radius_use_jit=1 # getsebool radius_use_jit radius_use_jit --> on # systemctl start radiusd # semodule -B And now it starts even in enforcing mode. Regards.
On 22. Aug 2025, at 13:33, Matthew Newton via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
On 22/08/2025 12:08, Alan DeKok via Freeradius-Users wrote:
On Aug 22, 2025, at 6:57 AM, mohair.scarves.0i--- via Freeradius-Users <freeradius-users@lists.freeradius.org> wrote:
I can confirm this problem on AlmaLinux 9. It seems to be related to the use of pcre2 which wasn’t used before. Well, that's unfriendly. I would suspect that it's related to the PCRE JIT. i.e. if you run it as root, the JIT can get executable memory. When you run it as a non-root user, the OS won't give the JIT executable memory.
Yes. Looks like PCRE2 with JIT needs selinux policies to work - disabling selinux will likely also fix the issue.
We had to put PCRE2 in because Rocky10 and Debian13 don't include PCRE1 any more. But the configure script then automatically picked that for the existing OSes as well.
We can likely patch the code, and issue RPMs of 3.2.8-1. I don't think there's a need for an official 3.2.9 yet.
Yeah, I'm working on 3.2.8-2 packages to flip it back to PCRE1.
Thanks Nick for debugging this one in detail.
-- Matthew
- List info/subscribe/unsubscribe? See http://www.freeradius.org/list/users.html
On 22/08/2025 13:19, mohair.scarves.0i--- via Freeradius-Users wrote:
O.K. I have checked the audit logs and there is nothing in there. But you are right, setting selinux to permissive allows the server to start.
Thus, I have disabled the dontaudit rules and checked the audit log again and then you can easily find the solution:
Thanks, yes. However, unlike the v4 dev packages, the v3 packages don't currently install a selinux policy. That would need adding to go down this route. -- Matthew
participants (6)
-
Alan DeKok -
Cyrus Humphreville -
Dan Oachs -
George Benjin -
Matthew Newton -
mohair.scarves.0i＠icloud.com