I've seen this sometime now, but not finding anything in the ubuntu man about this peculiar policy-rc.d binary that prevents services from being started/restarted/stopped when called by dpkg/apt, so I would like to know what is the reason of this.

Setting up lxc (0.9.0-0ubuntu3.6) ...
invoke-rc.d: policy-rc.d denied execution of start.
invoke-rc.d: policy-rc.d denied execution of start.
invoke-rc.d: policy-rc.d denied execution of start.

Apparently, no package owns this binary:

dpkg -S /usr/sbin/policy-rc.d
dpkg-query: no path found matching pattern /usr/sbin/policy-rc.d

1 Answer 1


This "script" is included in the sysv-rc package. This is part of a Debian policy which allows sysadmins to control what services starts/restarts/stops whenever they install/upgrade/uninstall packages:

POLICY-RC.D Policy layer (/usr/sbin/policy-rc.d) interface:

Most Debian systems will not have this script as the need for a policy layer is not very common. Most people using chroot jails just need an one-line script which returns an exit status of 101 as the jailed /usr/sbin/policy-rc.d script.

The /usr/sbin/policy-rc.d file must be managed through the alternatives system (/usr/sbin/update-alternatives) by any packages providing it.

/usr/sbin/policy-rc.d [options] []

/usr/sbin/policy-rc.d [options] --list [...]


So, what happens here? Well, whenever this script is present it will return a code which states the current policy of the local system (which is by default 101 = action forbidden by policy). If you want to change the policy, just modify the file as root to any of this values:

  0 - action allowed
  1 - unknown action (therefore, undefined policy)
 100 - unknown initscript id
 101 - action forbidden by policy
 102 - subsystem error
 103 - syntax error
 104 - [reserved]
 105 - behaviour uncertain, policy undefined.
 106 - action not allowed. Use the returned fallback actions
       (which are implied to be "allowed") instead. 

The script is still a place holder, but when completed all these values could be returned. If you want to allow any change just change exit 101 for exit 0 and done. Whenever you install/remove/upgrade a service these will be (re)started/stopped.

  • 6
    Docker images has a fixed exit 101 # For most Docker users, "apt-get install" only happens during "docker build", # where starting services doesn't work and often fails in humorous ways. This # prevents those failures by stopping the services from attempting to start. Mar 4, 2016 at 13:50
  • 2
    @Tjorriemorrie please can you elaborate? I am having this issue when building a docker image and I seem to be unable to fix it Jul 6, 2016 at 9:46
  • possible solution: monblocnotes.com/node/2057 Aug 27, 2016 at 6:48
  • @JonnyFlowers He refers to these lines, in docker's source
    – Bigood
    Sep 6, 2016 at 17:31
  • @Bigood: the line number changed in the recent master branch. Here is [a permalink to the lines in docker's source(github.com/moby/moby/blob/v17.05.0-ce/contrib/mkimage/…).
    – Hosam Aly
    Sep 10, 2017 at 21:08

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.