libvirt-daemon-driver-qemu-10.6.0-1.fc41.x86_64
selinux-policy-41.14-1.fc41.noarch

We are seeing this in the journal when one of our integration tests fails:

audit[6927]: AVC avc:  denied  { open } for  pid=6927 comm="swtpm" path="/var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log" dev="vda4" ino=127316 scontext=system_u:system_r:swtpm_t:s0 tcontext=system_u:object_r:virt_log_t:s0 tclass=file permissive=0
virtqemud[849]: internal error: Could not run '/usr/bin/swtpm_setup'. exitstatus: 1; Check error log '/var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log' for details.

setroubleshoot[4834]: SELinux is preventing swtpm from open access on the file /var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log. For complete SELinux messages run: sealert -l f4fb1e0e-4b5d-4c95-bff0-88259c09af62
setroubleshoot[4834]: SELinux is preventing swtpm from open access on the file /var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log.
                      
                      *****  Plugin restorecon (99.5 confidence) suggests   ************************
                      
                      If you want to fix the label. 
                      /var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log default label should be var_log_t.
                      Then you can run restorecon. The access attempt may have been stopped due to insufficient permissions to access a parent directory in which case try to change the following command accordingly.
                      Do
                      # /sbin/restorecon -v /var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log
                      
                      *****  Plugin catchall (1.49 confidence) suggests   **************************
                      
                      If you believe that swtpm should be allowed open access on the VmNotInstalled-swtpm.log file by default.
                      Then you should report this as a bug.
                      You can generate a local policy module to allow this access.
                      Do
                      allow this access for now by executing:
                      # ausearch -c 'swtpm' --raw | audit2allow -M my-swtpm
                      # semodule -X 300 -i my-swtpm.pp



However, right after this, we also see:

audit[6928]: AVC avc:  denied  { relabelfrom } for  pid=6928 comm="rpc-virtqemud" name="VmNotInstalled-swtpm.log" dev="vda4" ino=127316 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:virt_log_t:s0 tclass=file permissive=1

setroubleshoot[4834]: SELinux is preventing rpc-virtqemud from relabelfrom access on the file VmNotInstalled-swtpm.log. For complete SELinux messages run: sealert -l 2ed453d5-2d55-4a33-b9ba-3556f3c68dad
setroubleshoot[4834]: SELinux is preventing rpc-virtqemud from relabelfrom access on the file VmNotInstalled-swtpm.log.
                                                               
                      *****  Plugin catchall (100. confidence) suggests   **************************
                      
                      If you believe that rpc-virtqemud should be allowed relabelfrom access on the VmNotInstalled-swtpm.log file by default.
                      Then you should report this as a bug.
                      You can generate a local policy module to allow this access.
                      Do
                      allow this access for now by executing:
                      # ausearch -c 'rpc-virtqemud' --raw | audit2allow -M my-rpcvirtqemud
                      # semodule -X 300 -i my-rpcvirtqemud.pp

Note the "permissive=1" in the audit log.

In fact:

# ls -Z /var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log
system_u:object_r:var_log_t:s0 /var/log/swtpm/libvirt/qemu/VmNotInstalled-swtpm.log

And even more interestingly, a second run of the test in the same machine will succeed.

So this looks like rpc-virtqemud is relabeling the log file (and switches selinux off for that?), but does it too late.

Thus, I open this bug in libvirt. If you feel this is a policy bug, please reassign to selinux.


Reproducible: Always