Fedora-based sys-netdoes not start network when using bind-dirs configuration

[GWeck]

Qubes OS release

R4.2.3 with sys-net based on Fedora (-39, -40, or -40-xfce) template

Brief summary

If in Qubes R4.2 sys-net is based on a Fedora template, and a configuration file for NetworkManager is put via the bind-dirs mechanism into the /etc/NetworkManager/conf.d directory, starting sys-net leads to a system without network connections.

Steps to reproduce

Create a configuration file for the NetworkManager and put it into /rw/bind-dirs/etc/NetworkManager/config.d/. Let it be linked to its target location via binds+=( '/etc/NetworkManager/conf.d/<CONFIG>' ). Then start sys-net. Observe that the network is not started at all, but the file can be accessed in /etc/NetworkManager/conf.d/, and the network can be started manually. (Maybe a timing problem?)

Expected behavior

The network should be started and the configuration should be applied.

Actual behavior

sudo journalctl -b -u NetworkManager shows that starting NetworkManager fails with the message "Failed to read configuration: /etc/NetworkManager/conf.d/<configfile> : Permission denied"

Trying to access the configuration file from a terminal, e.g. via cat, succeeds without problems. Starting the NetworkManager manually via sudo NetworkManager succeeds and starts the network correctly, using the configuration specified in the file.

This error is independent of the contents of the configuration file; even if it contains only comments, the error occurs. Also, the error occurs only if sys-net is based on one of the fedora templates and gets the configuration file via bind-dirs, and it occurs only in Qubes R4.2. If the configuration file is put directly into the template or if Debian-12 is used as the template for sys-net, the network is started correctly. The error does not occur in Qubes R4.1.2.