I've seen this sometime now, but not finding anything in the ubuntu man about this peculiar policy-rc.d binary that prevents services from being started/restarted/stopped when called by dpkg/apt, so I would like to know what is the reason of this.

Setting up lxc (0.9.0-0ubuntu3.6) ...
invoke-rc.d: policy-rc.d denied execution of start.
invoke-rc.d: policy-rc.d denied execution of start.
invoke-rc.d: policy-rc.d denied execution of start.

Apparently, no package owns this binary:

dpkg -S /usr/sbin/policy-rc.d
dpkg-query: no path found matching pattern /usr/sbin/policy-rc.d
up vote 30 down vote accepted

This "script" is included in the sysv-rc package. This is part of a Debian policy which allows sysadmins to control what services starts/restarts/stops whenever they install/upgrade/uninstall packages:

POLICY-RC.D Policy layer (/usr/sbin/policy-rc.d) interface:

Most Debian systems will not have this script as the need for a policy layer is not very common. Most people using chroot jails just need an one-line script which returns an exit status of 101 as the jailed /usr/sbin/policy-rc.d script.

The /usr/sbin/policy-rc.d file must be managed through the alternatives system (/usr/sbin/update-alternatives) by any packages providing it.

/usr/sbin/policy-rc.d [options] []

/usr/sbin/policy-rc.d [options] --list [...]

(Source)

So, what happens here? Well, whenever this script is present it will return a code which states the current policy of the local system (which is by default 101 = action forbidden by policy). If you want to change the policy, just modify the file as root to any of this values:

  0 - action allowed
  1 - unknown action (therefore, undefined policy)
 100 - unknown initscript id
 101 - action forbidden by policy
 102 - subsystem error
 103 - syntax error
 104 - [reserved]
 105 - behaviour uncertain, policy undefined.
 106 - action not allowed. Use the returned fallback actions
       (which are implied to be "allowed") instead. 

The script is still a place holder, but when completed all these values could be returned. If you want to allow any change just change exit 101 for exit 0 and done. Whenever you install/remove/upgrade a service these will be (re)started/stopped.

  • 6
    Docker images has a fixed exit 101 # For most Docker users, "apt-get install" only happens during "docker build", # where starting services doesn't work and often fails in humorous ways. This # prevents those failures by stopping the services from attempting to start. – Tjorriemorrie Mar 4 '16 at 13:50
  • 2
    @Tjorriemorrie please can you elaborate? I am having this issue when building a docker image and I seem to be unable to fix it – Jonny Flowers Jul 6 '16 at 9:46
  • possible solution: monblocnotes.com/node/2057 – David Portabella Aug 27 '16 at 6:48
  • @JonnyFlowers He refers to these lines, in docker's source – Bigood Sep 6 '16 at 17:31
  • @Bigood: the line number changed in the recent master branch. Here is [a permalink to the lines in docker's source(github.com/moby/moby/blob/v17.05.0-ce/contrib/mkimage/…). – Hosam Aly Sep 10 '17 at 21:08

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.