When starting a Virtual Machine with 3D acceleration, the following problem appears. SELinux is preventing rpc-virtqemud from 'read, write' accesses on the chr_file renderD128. ***** Plugin catchall (100. confidence) suggests ************************** If you believe that rpc-virtqemud should be allowed read write access on the renderD128 chr_file by default. Then you should report this as a bug. You can generate a local policy module to allow this access. Do allow this access for now by executing: # ausearch -c 'rpc-virtqemud' --raw | audit2allow -M my-rpcvirtqemud # semodule -X 300 -i my-rpcvirtqemud.pp Additional Information: Source Context system_u:system_r:virtqemud_t:s0 Target Context system_u:object_r:dri_device_t:s0 Target Objects renderD128 [ chr_file ] Source rpc-virtqemud Source Path rpc-virtqemud Port <Unknown> Host fedora Source RPM Packages Target RPM Packages SELinux Policy RPM selinux-policy-targeted-41.40-1.fc42.noarch Local Policy RPM selinux-policy-targeted-41.40-1.fc42.noarch Selinux Enabled True Policy Type targeted Enforcing Mode Enforcing Host Name fedora Platform Linux fedora 6.14.6-300.fc42.x86_64 #1 SMP PREEMPT_DYNAMIC Fri May 9 20:11:19 UTC 2025 x86_64 Alert Count 12 First Seen 2025-05-19 07:52:11 CEST Last Seen 2025-05-22 03:38:04 CEST Local ID 2ac210ae-12ab-4f37-afe2-428a731df0bc Raw Audit Messages type=AVC msg=audit(1747877884.388:417): avc: denied { read write } for pid=55883 comm="rpc-virtqemud" name="renderD128" dev="tmpfs" ino=10 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:dri_device_t:s0 tclass=chr_file permissive=1 Hash: rpc-virtqemud,virtqemud_t,dri_device_t,chr_file,read,write Reproducible: Always Steps to Reproduce: 1.Create a Fedora 42 VM. 2.Enable 3D acceleration under `Video Virtio`. 3.Enable OpenGL and set Listen type to "None" under `Display Spice`. 4.Start the Virtual Machine. Actual Results: The virtual machine starts, but SELinux Troubleshooter shows 4 alerts. 3D acceleration seems to be working fine. Expected Results: No errors when starting a Virtual Machine with 3D acceleration enabled. Additional Information: Additionally, enabling 3D acceleration also causes these problems. SELinux is preventing rpc-virtqemud from open access on the chr_file /dev/dri/renderD128. SELinux is preventing rpc-virtqemud from lock access on the chr_file /dev/dri/renderD128. SELinux is preventing rpc-virtqemud from setattr access on the chr_file renderD128.
FEDORA-2025-d93e219f23 (selinux-policy-42.4-1.fc42) has been submitted as an update to Fedora 42. https://bodhi.fedoraproject.org/updates/FEDORA-2025-d93e219f23
FEDORA-2025-d93e219f23 has been pushed to the Fedora 42 testing repository. Soon you'll be able to install the update with the following command: `sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2025-d93e219f23` You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2025-d93e219f23 See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.
FEDORA-2025-d93e219f23 (selinux-policy-42.4-1.fc42) has been pushed to the Fedora 42 stable repository. If problem still persists, please make note of it in this bug report.
The issue still persists after updating the selinux-policy package. After following the steps in my first posts, I still see these problems: - SELinux is preventing rpc-virtqemud from open access on the chr_file /dev/dri/renderD128. - SELinux is preventing rpc-virtqemud from setattr access on the chr_file renderD128. These problems have been fixed after updating the package: - SELinux is preventing rpc-virtqemud from lock access on the chr_file /dev/dri/renderD128. - SELinux is preventing rpc-virtqemud from 'read, write' accesses on the chr_file renderD128. selinux-policy: 42.5 kernel: 6.15.9-201.fc42.x86_64