#43756·systemd

Portable services fail to spawn namespace "due to RF-kill"

Author: obalpetre-anssiCreated Sep 14, 2026Updated Sep 16, 2026

Labelsbug 🐛portabled

systemd version the issue has been seen with

systemd 261 (261.3-1-arch)

Used distribution

Arch

Linux kernel version used

7.2.4-arch1-2

CPU architectures issue was seen on

x86_64

Component

portablectl

Expected behaviour you didn't see

Systemd should be able to start a portable service it used to start successfully.

Unexpected behaviour you saw

The portable service fails to start. See below.

Steps to reproduce the problem

For the following portable service (created with mkosi 27):

# mkosi.conf
[Distribution]
Distribution=arch

[Output]
Format=portable

[Content]
Packages=
    base

# mkosi.extra/etc/systemd/system/anything.service
[Service]
ExecStart=/usr/bin/id

We create the portable service, attach it, and run it:

$ mkosi -fi --output anything
$ portablectl attach -p trusted mkosi.output/anything
$ systemctl start anything

The portable service is successfully attached, but running it fails (full journal log below):

$ systemctl status anything.service

systemd[1]: Started anything.service.
(id)[812]: anything.service: Failed to set up mount namespacing: Operation not possible due to RF-kill
(id)[812]: anything.service: Failed at step NAMESPACE spawning /usr/bin/id: Operation not possible due to RF-kill
systemd[1]: anything.service: Main process exited, code=exited, status=226/NAMESPACE
systemd[1]: anything.service: Failed with result 'exit-code'

This portable service:

fails on systemd 261 (261.3-1-arch)
fails on systemd 259 (259-1-arch)
succeeds on systemd 258 (258.3-1-arch)

This was tested by rolling back the packages systemd, systemd-libs, and systemd-sysvcompat (and only them).

The resulting anything.service service:

# /etc/systemd/system.attached/anything.service
[Service]
ExecStart=/usr/bin/id


# /etc/systemd/system.attached/anything.service.d/10-profile.conf -> /usr/lib/systemd/portable/profile/trusted/service.conf
# The "trusted" profile for services, i.e. no restrictions are applied apart from a private /tmp

[Service]
MountAPIVFS=yes
PrivateTmp=yes
BindPaths=/run
BindReadOnlyPaths=/etc/machine-id
BindReadOnlyPaths=-/etc/resolv.conf

# /etc/systemd/system.attached/anything.service.d/20-portable.conf
# Drop-in created for image '/root/portablectl/mkosi.output/anything.raw', do not edit.

[Service]
RootImage=/root/portablectl/mkosi.output/anything.raw
Environment=PORTABLE=anything.raw
LogExtraFields=PORTABLE=anything.raw
RootImagePolicy=root=read-only-on+growfs-off+erofs:=absent
LogExtraFields=PORTABLE_NAME_AND_VERSION=arch_rolling

Interestingly, manually creating the same service and commenting the RootImage= and RootImagePolicy= fields is enough to make it work:

# /etc/systemd/system/manual.service
[Service]
ExecStart=/usr/bin/id

[Service]
MountAPIVFS=yes
PrivateTmp=yes
BindPaths=/run
BindReadOnlyPaths=/etc/machine-id
BindReadOnlyPaths=-/etc/resolv.conf

[Service]
#RootImage=/root/portablectl/mkosi.output/anything.raw
Environment=PORTABLE=anything.raw
LogExtraFields=PORTABLE=anything.raw
#RootImagePolicy=root=read-only-on+growfs-off+erofs:=absent
LogExtraFields=PORTABLE_NAME_AND_VERSION=arch_rolling

$ systemctl start manual.service
$ systemctl status manual.service
○ manual.service
     Loaded: loaded (/etc/systemd/system/manual.service; static)
     Active: inactive (dead)

... systemd[1]: Started manual.service.
... id[1247]: uid=0(root) gid=0(root) groups=0(root)
... systemd[1]: manual.service: Deactivated successfully.

Note that all commands were executed by root.

Additional program output to the terminal or log subsystem illustrating the issue

bash

systemd[1]: Started anything.service.
audit[1]: SERVICE_START pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=anything comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
kernel: loop: module loaded
kernel: loop0: detected capacity change from 0 to 1091809
kernel:  loop0: p1
(id)[716]: anything.service: Failed to set up mount namespacing: Operation not possible due to RF-kill
(id)[716]: anything.service: Failed at step NAMESPACE spawning /usr/bin/id: Operation not possible due to RF-kill
systemd[1]: anything.service: Main process exited, code=exited, status=226/NAMESPACE
systemd[1]: anything.service: Failed with result 'exit-code'.
audit[1]: SERVICE_STOP pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=anything comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=failed'

Source: systemd/systemd

View original on GitHub View discussion on GitHub