Bug 2334271

Summary: SELinux: Starting swtpm with encrypted state fails
Product: [Fedora] Fedora Reporter: Stefan Berger <stefanb>
Component: swtpmAssignee: Stefan Berger <stefanb>
Status: CLOSED ERRATA QA Contact: Fedora Extras Quality Assurance <extras-qa>
Severity: medium Docs Contact:
Priority: unspecified    
Version: 41CC: davide, marcandre.lureau, stefanb
Target Milestone: ---Keywords: Regression
Target Release: ---   
Hardware: Unspecified   
OS: Linux   
Whiteboard:
Fixed In Version: swtpm-0.9.0-5.fc41 swtpm-0.9.0-3.fc40 Doc Type: ---
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2025-01-01 01:23:47 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description Stefan Berger 2024-12-26 23:05:46 UTC
When a VM is started with libvirt and its state is encrypted then swtpm fails to start with an error like the following:
```
error: Failed to start domain 'PLAIN-TPM-VM'
error: internal error: process exited while connecting to monitor: 2024-12-24T22:27:32.024764Z qemu-system-x86_64: tpm-emulator: TPM result for CMD_INIT: 0x101 operation failed
```
The underlying reason is a missing SELinux policy rule due to an entry like this in audit.log

```
type=AVC msg=audit(1735079251.599:81009): avc:  denied  { read } for  pid=1566858 comm="swtpm" path="pipe:[16515287]" dev="pipefs" ino=16515287 scontext=system_u:system_r:svirt_t:s0:c484,c858 tcontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tclass=fifo_file permissive=0
```

Running swtpm_setup worked -- see the log.

Reproducible: Always

Steps to Reproduce:
1. Define a VM with this type of TPM definition:

    <tpm model='tpm-crb'>
      <backend type='emulator' version='2.0'>
        <encryption secret='715ff528-5784-4506-918d-f2f30bc48d93'/>
        <profile name='default-v1'/>
      </backend>
    </tpm>

 2. Define a TPM secret with this XML and set is value to whatever you want:

<secret ephemeral='no' private='yes'>
   <uuid>715ff528-5784-4506-918d-f2f30bc48d93</uuid>
   <description>My vTPM secret</description>
   <usage type='vtpm'>
      <name>My vTPM secret</name>
   </usage>

virsh secret-set-value 715ff528-5784-4506-918d-f2f30bc48d93 123456

 3. virsh start PLAIN-TPM-VM

Actual Results:  

The logfile /var/log/swtpm/libvirt/qemu/PLAIN-TPM-VM-swtpm.log looks like this then:

Starting vTPM manufacturing as tss:tss @ Tue 24 Dec 2024 05:27:30 PM EST
Apply profile: {"Name": "default-v1"}
Warning: Profile-enabled algorithms contain disabled 'RSA-1024-sign(SHA1, pkcs1-pss)'
Warning: Setting OPENSSL_ENABLE_SHA1_SIGNATURES=1
[...]
Successfully authored TPM state.
Ending vTPM manufacturing @ Tue 24 Dec 2024 05:27:31 PM EST
Verification of HMAC failed. Data integrity is compromised
SWTPM_NVRAM_LoadData: Error from SWTPM_NVRAM_GetDecryptedData rc = 33
Verification of HMAC failed. Data integrity is compromised
SWTPM_NVRAM_LoadData: Error from SWTPM_NVRAM_GetDecryptedData rc = 33
libtpms/tpm2: Entering failure mode; code: 8, location: NvPowerOn line 175
Error: Could not initialize libtpms.
Error: Could not initialize the TPM
Data client disconnected


Expected Results:  
VM should start

Comment 1 Fedora Update System 2024-12-27 00:38:32 UTC
FEDORA-2024-c2c751215d (swtpm-0.9.0-5.fc41) has been submitted as an update to Fedora 41.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-c2c751215d

Comment 2 Fedora Update System 2024-12-27 00:38:55 UTC
FEDORA-2024-23605f77a2 (swtpm-0.9.0-3.fc40) has been submitted as an update to Fedora 40.
https://bodhi.fedoraproject.org/updates/FEDORA-2024-23605f77a2

Comment 3 Fedora Update System 2024-12-28 01:57:07 UTC
FEDORA-2024-c2c751215d has been pushed to the Fedora 41 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-c2c751215d`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-c2c751215d

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 4 Fedora Update System 2024-12-28 03:40:12 UTC
FEDORA-2024-23605f77a2 has been pushed to the Fedora 40 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-23605f77a2`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-23605f77a2

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 5 Fedora Update System 2025-01-01 01:23:47 UTC
FEDORA-2024-c2c751215d (swtpm-0.9.0-5.fc41) has been pushed to the Fedora 41 stable repository.
If problem still persists, please make note of it in this bug report.

Comment 6 Fedora Update System 2025-01-12 01:42:22 UTC
FEDORA-2024-23605f77a2 (swtpm-0.9.0-3.fc40) has been pushed to the Fedora 40 stable repository.
If problem still persists, please make note of it in this bug report.