In latest version of bazzite, I cant launch a windows 11 VM that previously worked fine (as in, worked fine up until a few days ago). I get a bunch of selinux denials related to the software TPM module:
type=AVC msg=audit(1787692573.830:614): avc: denied { setattr } for pid=25904 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1
type=AVC msg=audit(1787692573.831:615): avc: denied { write } for pid=33778 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1
type=AVC msg=audit(1787692573.831:616): avc: denied { relabelfrom } for pid=33778 comm=“rpc-virtqemud” name=“tpm2” dev=“nvme0n1p6” ino=111059 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1787692573.831:617): avc: denied { relabelfrom } for pid=33778 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1
type=AVC msg=audit(1787692573.834:618): avc: denied { entrypoint } for pid=33782 comm=“rpc-virtqemud” path=“/usr/bin/swtpm” dev=“overlay” ino=11943 scontext=system_u:system_r:svirt_t:s0:c33,c905 tcontext=system_u:object_r:bin_t:s0 tclass=file permissive=0
type=AVC msg=audit(1787692573.837:619): avc: denied { relabelto } for pid=33783 comm=“rpc-virtqemud” name=“tpm2” dev=“nvme0n1p6” ino=111059 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=dir permissive=1
type=AVC msg=audit(1787692573.837:620): avc: denied { relabelto } for pid=33783 comm=“rpc-virtqemud” name=“.lock” dev=“nvme0n1p6” ino=111061 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:virt_var_lib_t:s0 tclass=file permissive=1
type=AVC msg=audit(1787692573.837:621): avc: denied { relabelto } for pid=33783 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:object_r:var_log_t:s0 tclass=file permissive=1
I believe the issue is related to the labelling of the software TPM module. if i disable or put selinux in permissive, it works fine. It worked fine until a few days ago, so I assume this is an issue with the latest update.
Im unsure how to fix this - if i autdit2allow those denials, will that survive a reboot on bazzite? Or should this be fixed in the selinux policies applied to the system, and so I should just switch to permissive for now until it gets fixed upstream?