Bug 2511086 - SELinux update mislabels swtpm and causes VMs to be unable to launch
Summary: SELinux update mislabels swtpm and causes VMs to be unable to launch
Keywords:
Status: CLOSED ERRATA
Alias: None
Product: Fedora
Classification: Fedora
Component: swtpm
Version: 44
Hardware: x86_64
OS: Linux
unspecified
medium
Target Milestone: ---
Assignee: Zdenek Pytela
QA Contact: Fedora Extras Quality Assurance
URL: https://discussion.fedoraproject.org/...
Whiteboard:
Depends On:
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-08-04 16:34 UTC by Yosuke Matsumura
Modified: 2026-08-06 17:17 UTC (History)
10 users (show)

Fixed In Version: swtpm-0.10.1-4.fc44
Clone Of:
Environment:
Last Closed: 2026-08-06 17:17:25 UTC
Type: ---
Embargoed:


Attachments (Terms of Use)

Description Yosuke Matsumura 2026-08-04 16:34:56 UTC
Updating Fedora Kinoite from 20260731.0 to 20260804.0 causes swtpm to be mislabeled from swtpm_exec_t to bin_t. The swtpm entries are missing in /etc/selinux/targeted/active/modules/200 and do not appear when `semodule -l` under 20260804.0 whereas they are present in 20260731.0.

Error Message
------------------------------------------
Error starting domain: operation failed: swtpm died and reported: libvirt:  error : cannot execute binary /usr/bin/swtpm: Permission denied
Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 67, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 101, in tmpcb
    callback(*args, **kwargs)
    ~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn
    ret = fn(self, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/object/domain.py", line 1446, in startup
    self._backend.create()
    ~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib64/python3.14/site-packages/libvirt.py", line 1395, in create
    raise libvirtError('virDomainCreate() failed')
libvirt.libvirtError: operation failed: swtpm died and reported: libvirt:  error : cannot execute binary /usr/bin/swtpm: Permission denied




20260731.0 (before update)
------------------------------------------
 yosuke@fedora-pc  ~  rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
  fedora:fedora/44/x86_64/kinoite
                  Version: 44.20260804.0 (2026-08-04T00:34:22Z)
               BaseCommit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da
             GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
                     Diff: 43 upgraded, 1 removed, 1 added
      RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44
          LayeredPackages: doas libvirt neovim tmux virt-manager zsh

● fedora:fedora/44/x86_64/kinoite
                  Version: 44.20260731.0 (2026-07-31T00:35:32Z)
               BaseCommit: d77b22e2e5fe7d0504f46cdf7772f17a250998f887307e9b46231e31c777663d
             GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
      RemovedBasePackages: firefox firefox-langpacks 153.0-3.fc44
          LayeredPackages: doas libvirt neovim tmux virt-manager zsh

AvailableUpdate:
        Version: 44.20260804.0 (2026-08-04T00:34:22Z)
         Commit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da
   GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
  SecAdvisories: 3 important
           Diff: 45 upgraded, 1 removed, 1 added

 yosuke@fedora-pc  ~  /bin/ls -lZ /usr/bin/swtpm
-rwxr-xr-x. 1 root root system_u:object_r:swtpm_exec_t:s0 42200 Dec 31  1969 /usr/bin/swtpm

 yosuke@fedora-pc  ~  doas semodule -l | grep swtpm
swtpm
swtpm_libvirt
swtpm_svirt

 yosuke@fedora-pc  ~  doas ls -l /etc/selinux/targeted/active/modules/200
total 0
drwx------. 1 root root 28 Jul 31 05:45 container
drwx------. 1 root root 28 Jul 31 05:45 flatpak
drwx------. 1 root root 28 Jul 31 05:45 mariadb-plugin-cracklib-password-check
drwx------. 1 root root 28 Jul 31 05:45 mysql
drwx------. 1 root root 28 Jul 31 05:45 nbdkit
drwx------. 1 root root 28 Jul 31 05:45 passt
drwx------. 1 root root 28 Jul 31 05:45 passt-repair
drwx------. 1 root root 28 Jul 31 05:45 pasta
drwx------. 1 root root 28 Jul 31 05:45 pesto
drwx------. 1 root root 28 Jul 31 05:45 smartmon
drwx------. 1 root root 28 Jul 31 05:45 swtpm
drwx------. 1 root root 28 Jul 31 05:45 swtpm_libvirt
drwx------. 1 root root 28 Jul 31 05:45 swtpm_svirt





20260804.0 (after update)
------------------------------------------
 yosuke@fedora-pc  ~  rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● fedora:fedora/44/x86_64/kinoite
                  Version: 44.20260804.0 (2026-08-04T00:34:22Z)
               BaseCommit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da
             GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
      RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44
          LayeredPackages: doas libvirt neovim tmux virt-manager zsh

  fedora:fedora/44/x86_64/kinoite
                  Version: 44.20260731.0 (2026-07-31T00:35:32Z)
               BaseCommit: d77b22e2e5fe7d0504f46cdf7772f17a250998f887307e9b46231e31c777663d
             GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
      RemovedBasePackages: firefox firefox-langpacks 153.0-3.fc44
          LayeredPackages: doas libvirt neovim tmux virt-manager zsh

 yosuke@fedora-pc  ~  /bin/ls -lZ /usr/bin/swtpm
-rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 42200 Dec 31  1969 /usr/bin/swtpm

 yosuke@fedora-pc  ~  doas semodule -l | grep swtpm

 ✘ yosuke@fedora-pc  ~  doas ls -l /etc/selinux/targeted/active/modules/200
total 0
drwx------. 1 root root 28 Aug  4 06:04 container
drwx------. 1 root root 28 Aug  4 06:04 flatpak
drwx------. 1 root root 28 Aug  4 06:04 mariadb-plugin-cracklib-password-check
drwx------. 1 root root 28 Aug  4 06:04 mysql
drwx------. 1 root root 28 Aug  4 06:04 nbdkit
drwx------. 1 root root 28 Aug  4 06:04 passt
drwx------. 1 root root 28 Aug  4 06:04 passt-repair
drwx------. 1 root root 28 Aug  4 06:04 pasta
drwx------. 1 root root 28 Aug  4 06:04 pesto
drwx------. 1 root root 28 Aug  4 06:04 smartmon

Reproducible: Always

Steps to Reproduce:
1. Update system to 20260804.0
2. Try to run a VM with a virtual TPM
3. 
Actual Results:
VM fails to start with error.

Expected Results:
VM starts successfully.

Additional Information:
AI Analysis:

The real failure is in the journal, from the update itself at 06:03 today:
Line 77 of the converted swtpm.pp is (tunableif (virt_use_nfs) …), and virt_use_nfs is a boolean in the loaded policy (getsebool virt_use_nfs → on), so the compiler can't resolve it as a tunable. Since the %post ends in || :, the failure was swallowed and the deployment was built without the swtpm modules.

The 07-31 base shipped SELinux userspace 3.10; the 08-04 base bumped it: libsepol, libsemanage, libselinux, checkpolicy, policycoreutils all 3.10 → 3.11. swtpm-selinux-0.10.1-3 and selinux-policy-44.5-1 are byte-identical in both deployments.

What changed semantically in 3.11:

swtpm.pp contains (tunableif (virt_use_nfs) …), but the installed policy declares virt_use_nfs as a boolean (getsebool virt_use_nfs → on). 3.10 tolerated that mismatch; 3.11 turns it into a hard resolution failure. Confirmed by flag testing under 3.11 on scratch copies:

•  semodule -P (preserve tunables) → exit 0, modules install
•  semodule -C (ignore HLL→CIL module cache) → still fails

That rules out a stale module cache and points squarely at tunable-vs-boolean resolution semantics. It's an upstream incompatibility between swtpm-selinux's prebuilt .pp and userspace 3.11 — worth filing against swtpm-selinux (needs a rebuild emitting booleanif) or as a 3.11 regression.

Comment 1 Stefan Berger 2026-08-04 19:42:50 UTC
Can you judge whether this patch will resolve the issue? https://github.com/stefanberger/swtpm/commit/db2386b2c1530de3a7fa57a8214c3630e785ec2f

Comment 2 Yosuke Matsumura 2026-08-04 20:21:47 UTC
(In reply to Stefan Berger from comment #1)
> Can you judge whether this patch will resolve the issue?
> https://github.com/stefanberger/swtpm/commit/
> db2386b2c1530de3a7fa57a8214c3630e785ec2f

This patch resolves the issue, based on local testing.

Comment 3 Fedora Update System 2026-08-04 22:28:29 UTC
FEDORA-2026-aa55df3280 (swtpm-0.10.1-4.fc44) has been submitted as an update to Fedora 44.
https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280

Comment 4 Stefan Berger 2026-08-04 22:29:17 UTC
I built a package with that patch applied: https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280

dnf install python3-bodhi-client
bodhi updates download --updateid FEDORA-2026-aa55df3280

Comment 5 Yosuke Matsumura 2026-08-04 22:57:06 UTC
Applied the patched package from Bodhi and confirm that issue is resolved.

Comment 6 Fedora Update System 2026-08-05 01:57:36 UTC
FEDORA-2026-aa55df3280 has been pushed to the Fedora 44 testing repository.
Soon you'll be able to install the update with the following command:
`sudo dnf upgrade --enablerepo=updates-testing --refresh --advisory=FEDORA-2026-aa55df3280`
You can provide feedback for this update here: https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280

See also https://fedoraproject.org/wiki/QA:Updates_Testing for more information on how to test updates.

Comment 7 Fedora Update System 2026-08-06 17:17:25 UTC
FEDORA-2026-aa55df3280 (swtpm-0.10.1-4.fc44) has been pushed to the Fedora 44 stable repository.
If problem still persists, please make note of it in this bug report.


Note You need to log in before you can comment on or make changes to this bug.