The map permission is currently not allowed:

  #sesearch -A -s svirt_t -t svirt_t -c anon_inode
allow svirt_t svirt_t:anon_inode { create getattr ioctl read write };

policy/modules/kernel/domain.te:allow domain self:anon_inode userfaultfd_anon_inode_perms;
policy/support/obj_perm_sets.spt:define(`userfaultfd_anon_inode_perms',`{ create getattr ioctl read write }')

*** Bug 2031415 has been marked as a duplicate of this bug. ***

*** Bug 2028275 has been marked as a duplicate of this bug. ***

*** Bug 2047947 has been marked as a duplicate of this bug. ***

I can confirm the same - whenever I launch a KVM virtual machine, I get this alert.
SELinux is preventing qemu-system-x86 from map access on the anon_inode anon_inode.

Source Context                system_u:system_r:svirt_t:s0:c585,c973
Target Context                system_u:object_r:svirt_t:s0:c585,c973
Target Objects                anon_inode [ anon_inode ]
Source                        qemu-system-x86
Source Path                   qemu-system-x86
Port                          <Unknown>
Host                          ********
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-35.11-1.fc35.noarch
Local Policy RPM              selinux-policy-targeted-35.11-1.fc35.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     ********
Platform                      Linux ******** 5.16.4-200.fc35.x86_64 #1 SMP

Similar problem has been detected:

1.  Start system after power on
2. Start VM in virt-manager

hashmarkername: setroubleshoot
kernel:         5.16.5-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Similar problem has been detected:

Restarting after Fedora updates

hashmarkername: setroubleshoot
kernel:         5.16.5-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

*** Bug 2051195 has been marked as a duplicate of this bug. ***

*** Bug 2026746 has been marked as a duplicate of this bug. ***

Ondrej,

Denials like this started to appear. We currently have support for anon_inode consisting of

allow domain self:anon_inode userfaultfd_anon_inode_perms;
define(`userfaultfd_anon_inode_perms',`{ create getattr ioctl read write }')

and unused interface fs_rw_anon_inodefs_files().

Should handling of io_uring be different, or can we just add the map permission to the existing set?

For now let's just add the map permission to the macro (and rename it to e.g. general_anon_inode_perms, since userfaultfd is no longer the only anon_inode kind supported). To handle anon_inode better we would need the self keyword support for type transitions, which is yet to be implemented...

Thank you, done.
https://github.com/fedora-selinux/selinux-policy/pull/1052

Similar problem has been detected:

opening up viirtual machine manager throws this SELinux warning. VM still starts

hashmarkername: setroubleshoot
kernel:         5.16.5-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

*** Bug 2051827 has been marked as a duplicate of this bug. ***

Similar problem has been detected:

Launching Virtual Machine Manager from Gnome Desktop on F35

hashmarkername: setroubleshoot
kernel:         5.16.5-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Similar problem has been detected:

Happened at the startup. The only thing i did before rebooting was updating, and a day ago I disabled nvidia-powerd.service. Those are the only clues i have

hashmarkername: setroubleshoot
kernel:         5.16.7-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Similar problem has been detected:

Even qemu-img (from qemu-img-6.1.0.x86_64) called without arguments triggers this alert.

hashmarkername: setroubleshoot
kernel:         5.16.7-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-img from 'map' accesses on the anon_inode anon_inode.

*** Bug 2053425 has been marked as a duplicate of this bug. ***

*** Bug 2053467 has been marked as a duplicate of this bug. ***

Similar problem has been detected:

i sent my laptop to suspend a few hours ago, it wont come up from that, the led keeps "dimming", an the mic-mute-led kept shining.
i hard stopped the notebook py pressing power 8sec. after reboot the SELinux-Thing here come up.

hashmarkername: setroubleshoot
kernel:         5.16.7-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-kvm from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Similar problem has been detected:

Lancement de libvirt-manager

hashmarkername: setroubleshoot
kernel:         5.16.7-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Similar problem has been detected:

Starting virt-manager after reboot.

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

*** Bug 2053857 has been marked as a duplicate of this bug. ***

*** Bug 2053973 has been marked as a duplicate of this bug. ***

Similar problem has been detected:

At system startup

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

FEDORA-2022-5bcfd81271 has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-5bcfd81271

Similar problem has been detected:

I am running a FreeBSD VM in a qemu-based libvirtd (virt-manager) managed machine. This may be related.

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-img from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Similar problem has been detected:

Just opening up gnome-boxes

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

*** Bug 2054616 has been marked as a duplicate of this bug. ***

FEDORA-2022-aa5df3a7eb has been submitted as an update to Fedora 35. https://bodhi.fedoraproject.org/updates/FEDORA-2022-aa5df3a7eb

Hi Zdenek ! FYI @zpytela : selinux-policy-35.15-1.fc35 seems to work fine - no messages after launching virtual machines. 
No warnings during the installation process like those that appeared while installing selinux-policy-35.14-1.fc35 before.

(In reply to Christian Labisch from comment #31)
> Hi Zdenek ! FYI @zpytela : selinux-policy-35.15-1.fc35 seems to work fine -
> no messages after launching virtual machines. 
> No warnings during the installation process like those that appeared while
> installing selinux-policy-35.14-1.fc35 before.

Glad to hear that, thanks for the feedback.

FEDORA-2022-aa5df3a7eb has been pushed to the Fedora 35 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --advisory=FEDORA-2022-aa5df3a7eb`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2022-aa5df3a7eb

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Similar problem has been detected:

Running "vagrant up"

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Unfortunately I'm still seeing this with the following version:
selinux-policy.noarch                   35.13-1.fc35           @updates-testing
selinux-policy-targeted.noarch          35.13-1.fc35           @updates-testing

(In reply to David Auer (2nd Account) from comment #35)
> Unfortunately I'm still seeing this with the following version:
> selinux-policy.noarch                   35.13-1.fc35          
> @updates-testing
> selinux-policy-targeted.noarch          35.13-1.fc35          
> @updates-testing

Hi David,

You may want to apply the latest patches -> https://bodhi.fedoraproject.org/updates/FEDORA-2022-aa5df3a7eb ... selinux-policy-35.15-1.fc35 has resolved the issues.

Regards,
Christian

Hi Christian,

sorry I failed to spot the difference between 35.1*3* and 35.1*5* here, my bad.
Additionally I ran into the rare situation where dnf needed a `--refresh` to get that update. Thanks for the fix and for the help!

Cheers,
David

Similar problem has been detected:

Applied current updates (as of 10am ET 2-16-2022) and rebooted.

qemu was running at time of reboot and suspended the running image as part of shutdown.

At login, I received this error.  Then when I went to connect to qemu via the consule, I got lots of errors reported.

I did catch that this is supposedly fixed with selinux-policy-35.15-1.fc35 from the testing repo, and have applied it.
Note, this was not easy.  The command was in a dialog box that did not support copy to clipboard, and I had to read
the needed command and type it into a terminal window.

Will see if this update will address the problem.

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

FWIIW:

I see that I got this error 78 times before I was able to get it to 'ignore':

SELinux is preventing qemu-system-x86 from map access on the anon_inode anon_inode.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that qemu-system-x86 should be allowed map access on the anon_inode anon_inode by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86
# semodule -X 300 -i my-qemusystemx86.pp

Additional Information:
Source Context                system_u:system_r:virtd_t:s0-s0:c0.c1023
Target Context                system_u:object_r:virtd_t:s0
Target Objects                anon_inode [ anon_inode ]
Source                        qemu-system-x86
Source Path                   qemu-system-x86
Port                          <Unknown>
Host                          lx140e.htt-consult.com
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-35.13-1.fc35.noarch
Local Policy RPM              selinux-policy-targeted-35.13-1.fc35.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     lx140e.htt-consult.com
Platform                      Linux lx140e.htt-consult.com
                              5.16.8-200.fc35.x86_64 #1 SMP PREEMPT Tue Feb 8
                              20:58:59 UTC 2022 x86_64 x86_64
Alert Count                   78
First Seen                    2022-02-16 10:22:46 EST
Last Seen                     2022-02-16 10:30:41 EST
Local ID                      545770cf-60d6-4bcb-8b77-6e9ee0b6d2c2

Raw Audit Messages
type=AVC msg=audit(1645025441.136:403): avc:  denied  { map } for  pid=4531 comm="qemu-system-xte" path="anon_inode:[io_uring]" dev="anon_inodefs" ino=71921 scontext=system_u:system_r:virtd_t:s0-s0:c0.c1023 tcontext=system_u:object_r:virtd_t:s0 tclass=anon_inode permissive=0


Hash: qemu-system-x86,virtd_t,virtd_t,anon_inode,map

======

As noted above, I have applied the selinux-policy update.

FEDORA-2022-aa5df3a7eb has been pushed to the Fedora 35 stable repository.
If problem still persists, please make note of it in this bug report.

Similar problem has been detected:

I started a virtual machine from /dev/sdd

hashmarkername: setroubleshoot
kernel:         5.16.8-200.fc35.x86_64
package:        selinux-policy-targeted-35.13-1.fc35.noarch
reason:         SELinux is preventing qemu-system-x86 from 'map' accesses on the anon_inode anon_inode.
type:           libreport

Hey Aleksandar, Hey Robert,

you both report seeing this issue with selinux-policy-targeted-35.13. Please make sure you update to 35.15 and try again, that should fix it.

Best regards

David

*** Bug 2058029 has been marked as a duplicate of this bug. ***