Description of problem: I'm using tofu (terraform) libvirt plugin to locally test deployments. After upgrade to Fedora 40, I got the following AVC error: type=AVC msg=audit(1718108318.143:806): avc: denied { write } for pid=33218 comm="rpc-virtproxyd" name="io.systemd.Machine" dev="tmpfs" ino=1865 scontext=system_u:system_r:virtproxyd_t:s0 tcontext=system_u:object_r:systemd_userdbd_runtime_t:s0 tclass=sock_file permissive=0 I solved the issue with the following selinux moodule (generated with audit2allow): module libvirt 1.0; require { type policykit_t; type virtproxyd_t; class dbus send_msg; } #============= virtproxyd_t ============== allow virtproxyd_t policykit_t:dbus send_msg; Version-Release number of selected component (if applicable): selinux-policy-40.20-1.fc40.noarch selinux-policy-targeted-40.20-1.fc40.noarch libvirt-daemon-10.1.0-1.fc40.x86_64
Sorry for this, I did not copied the correct AVC line, here is the relevant one: type=USER_AVC msg=audit(1718107457.880:794): pid=1365 uid=81 auid=4294967295 ses=4294967295 subj=system_u:system_r:system_dbusd_t:s0-s0:c0.c1023 msg='avc: denied { send_msg } for scontext=system_u:system_r:virtproxyd_t:s0 tcontext=system_u:system_r:policykit_t:s0 tclass=dbus permissive=0 exe="/usr/bin/dbus-broker" sauid=81 hostname=? addr=? terminal=?'
Olivier, The first denial is also affecting some service?
I did not act specifically on the first denial, only on the second one with the proposed selinux module. And at this does not seem to affect my current use, at least I did not detected strange behaviour.
FEDORA-2024-2bc43119f3 (selinux-policy-40.23-1.fc40) has been submitted as an update to Fedora 40. https://bodhi.fedoraproject.org/updates/FEDORA-2024-2bc43119f3
FEDORA-2024-2bc43119f3 has been pushed to the Fedora 40 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2024-2bc43119f3` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2024-2bc43119f3 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2024-2bc43119f3 (selinux-policy-40.23-1.fc40) has been pushed to the Fedora 40 stable repository. If problem still persists, please make note of it in this bug report.