Bug 2511086
| Summary: | SELinux update mislabels swtpm and causes VMs to be unable to launch | ||
|---|---|---|---|
| Product: | [Fedora] Fedora | Reporter: | Yosuke Matsumura <yosukematsumura> |
| Component: | swtpm | Assignee: | Zdenek Pytela <zpytela> |
| Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
| Severity: | medium | Docs Contact: | |
| Priority: | unspecified | ||
| Version: | 44 | CC: | davide, dwalsh, lvrabec, marcandre.lureau, mmalik, omosnacek, pkoncity, stefanb, vmojzis, zpytela |
| Target Milestone: | --- | Keywords: | Desktop, Regression, Upgrades |
| Target Release: | --- | ||
| Hardware: | x86_64 | ||
| OS: | Linux | ||
| URL: | https://discussion.fedoraproject.org/t/f44-update-mislabels-swtpm-unable-to-run-vms/198418 | ||
| Whiteboard: | |||
| Fixed In Version: | swtpm-0.10.1-4.fc44 | Doc Type: | --- |
| Doc Text: | Story Points: | --- | |
| Clone Of: | Environment: | ||
| Last Closed: | 2026-08-06 17:17:25 UTC | Type: | --- |
| Regression: | --- | Mount Type: | --- |
| Documentation: | --- | CRM: | |
| Verified Versions: | Category: | --- | |
| oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
| Cloudforms Team: | --- | Target Upstream Version: | |
| Embargoed: | |||
Can you judge whether this patch will resolve the issue? https://github.com/stefanberger/swtpm/commit/db2386b2c1530de3a7fa57a8214c3630e785ec2f (In reply to Stefan Berger from comment #1) > Can you judge whether this patch will resolve the issue? > https://github.com/stefanberger/swtpm/commit/ > db2386b2c1530de3a7fa57a8214c3630e785ec2f This patch resolves the issue, based on local testing. FEDORA-2026-aa55df3280 (swtpm-0.10.1-4.fc44) has been submitted as an update to Fedora 44. https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280 I built a package with that patch applied: https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280 dnf install python3-bodhi-client bodhi updates download --updateid FEDORA-2026-aa55df3280 Applied the patched package from Bodhi and confirm that issue is resolved. FEDORA-2026-aa55df3280 has been pushed to the Fedora 44 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-aa55df3280` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates. FEDORA-2026-aa55df3280 (swtpm-0.10.1-4.fc44) has been pushed to the Fedora 44 stable repository. If problem still persists, please make note of it in this bug report. |
Updating Fedora Kinoite from 20260731.0 to 20260804.0 causes swtpm to be mislabeled from swtpm_exec_t to bin_t. The swtpm entries are missing in /etc/selinux/targeted/active/modules/200 and do not appear when `semodule -l` under 20260804.0 whereas they are present in 20260731.0. Error Message ------------------------------------------ Error starting domain: operation failed: swtpm died and reported: libvirt: error : cannot execute binary /usr/bin/swtpm: Permission denied Traceback (most recent call last): File "/usr/share/virt-manager/virtManager/asyncjob.py", line 67, in cb_wrapper callback(asyncjob, *args, **kwargs) ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^ File "/usr/share/virt-manager/virtManager/asyncjob.py", line 101, in tmpcb callback(*args, **kwargs) ~~~~~~~~^^^^^^^^^^^^^^^^^ File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn ret = fn(self, *args, **kwargs) File "/usr/share/virt-manager/virtManager/object/domain.py", line 1446, in startup self._backend.create() ~~~~~~~~~~~~~~~~~~~~^^ File "/usr/lib64/python3.14/site-packages/libvirt.py", line 1395, in create raise libvirtError('virDomainCreate() failed') libvirt.libvirtError: operation failed: swtpm died and reported: libvirt: error : cannot execute binary /usr/bin/swtpm: Permission denied 20260731.0 (before update) ------------------------------------------ yosuke@fedora-pc ~ rpm-ostree status State: idle AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot Deployments: fedora:fedora/44/x86_64/kinoite Version: 44.20260804.0 (2026-08-04T00:34:22Z) BaseCommit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6 Diff: 43 upgraded, 1 removed, 1 added RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44 LayeredPackages: doas libvirt neovim tmux virt-manager zsh ● fedora:fedora/44/x86_64/kinoite Version: 44.20260731.0 (2026-07-31T00:35:32Z) BaseCommit: d77b22e2e5fe7d0504f46cdf7772f17a250998f887307e9b46231e31c777663d GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6 RemovedBasePackages: firefox firefox-langpacks 153.0-3.fc44 LayeredPackages: doas libvirt neovim tmux virt-manager zsh AvailableUpdate: Version: 44.20260804.0 (2026-08-04T00:34:22Z) Commit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6 SecAdvisories: 3 important Diff: 45 upgraded, 1 removed, 1 added yosuke@fedora-pc ~ /bin/ls -lZ /usr/bin/swtpm -rwxr-xr-x. 1 root root system_u:object_r:swtpm_exec_t:s0 42200 Dec 31 1969 /usr/bin/swtpm yosuke@fedora-pc ~ doas semodule -l | grep swtpm swtpm swtpm_libvirt swtpm_svirt yosuke@fedora-pc ~ doas ls -l /etc/selinux/targeted/active/modules/200 total 0 drwx------. 1 root root 28 Jul 31 05:45 container drwx------. 1 root root 28 Jul 31 05:45 flatpak drwx------. 1 root root 28 Jul 31 05:45 mariadb-plugin-cracklib-password-check drwx------. 1 root root 28 Jul 31 05:45 mysql drwx------. 1 root root 28 Jul 31 05:45 nbdkit drwx------. 1 root root 28 Jul 31 05:45 passt drwx------. 1 root root 28 Jul 31 05:45 passt-repair drwx------. 1 root root 28 Jul 31 05:45 pasta drwx------. 1 root root 28 Jul 31 05:45 pesto drwx------. 1 root root 28 Jul 31 05:45 smartmon drwx------. 1 root root 28 Jul 31 05:45 swtpm drwx------. 1 root root 28 Jul 31 05:45 swtpm_libvirt drwx------. 1 root root 28 Jul 31 05:45 swtpm_svirt 20260804.0 (after update) ------------------------------------------ yosuke@fedora-pc ~ rpm-ostree status State: idle AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot Deployments: ● fedora:fedora/44/x86_64/kinoite Version: 44.20260804.0 (2026-08-04T00:34:22Z) BaseCommit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6 RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44 LayeredPackages: doas libvirt neovim tmux virt-manager zsh fedora:fedora/44/x86_64/kinoite Version: 44.20260731.0 (2026-07-31T00:35:32Z) BaseCommit: d77b22e2e5fe7d0504f46cdf7772f17a250998f887307e9b46231e31c777663d GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6 RemovedBasePackages: firefox firefox-langpacks 153.0-3.fc44 LayeredPackages: doas libvirt neovim tmux virt-manager zsh yosuke@fedora-pc ~ /bin/ls -lZ /usr/bin/swtpm -rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 42200 Dec 31 1969 /usr/bin/swtpm yosuke@fedora-pc ~ doas semodule -l | grep swtpm ✘ yosuke@fedora-pc ~ doas ls -l /etc/selinux/targeted/active/modules/200 total 0 drwx------. 1 root root 28 Aug 4 06:04 container drwx------. 1 root root 28 Aug 4 06:04 flatpak drwx------. 1 root root 28 Aug 4 06:04 mariadb-plugin-cracklib-password-check drwx------. 1 root root 28 Aug 4 06:04 mysql drwx------. 1 root root 28 Aug 4 06:04 nbdkit drwx------. 1 root root 28 Aug 4 06:04 passt drwx------. 1 root root 28 Aug 4 06:04 passt-repair drwx------. 1 root root 28 Aug 4 06:04 pasta drwx------. 1 root root 28 Aug 4 06:04 pesto drwx------. 1 root root 28 Aug 4 06:04 smartmon Reproducible: Always Steps to Reproduce: 1. Update system to 20260804.0 2. Try to run a VM with a virtual TPM 3. Actual Results: VM fails to start with error. Expected Results: VM starts successfully. Additional Information: AI Analysis: The real failure is in the journal, from the update itself at 06:03 today: Line 77 of the converted swtpm.pp is (tunableif (virt_use_nfs) …), and virt_use_nfs is a boolean in the loaded policy (getsebool virt_use_nfs → on), so the compiler can't resolve it as a tunable. Since the %post ends in || :, the failure was swallowed and the deployment was built without the swtpm modules. The 07-31 base shipped SELinux userspace 3.10; the 08-04 base bumped it: libsepol, libsemanage, libselinux, checkpolicy, policycoreutils all 3.10 → 3.11. swtpm-selinux-0.10.1-3 and selinux-policy-44.5-1 are byte-identical in both deployments. What changed semantically in 3.11: swtpm.pp contains (tunableif (virt_use_nfs) …), but the installed policy declares virt_use_nfs as a boolean (getsebool virt_use_nfs → on). 3.10 tolerated that mismatch; 3.11 turns it into a hard resolution failure. Confirmed by flag testing under 3.11 on scratch copies: • semodule -P (preserve tunables) → exit 0, modules install • semodule -C (ignore HLL→CIL module cache) → still fails That rules out a stale module cache and points squarely at tunable-vs-boolean resolution semantics. It's an upstream incompatibility between swtpm-selinux's prebuilt .pp and userspace 3.11 — worth filing against swtpm-selinux (needs a rebuild emitting booleanif) or as a 3.11 regression.