# Selinux problems with libvirt/tpm in latest version of Bazzite

**URL:** <https://universal-blue.discourse.group/t/selinux-problems-with-libvirt-tpm-in-latest-version-of-bazzite/12419>\
**Category:** Bazzite\
**Created:** [August 25, 2026, 9:28pm UTC](https://universal-blue.discourse.group/t/selinux-problems-with-libvirt-tpm-in-latest-version-of-bazzite/12419 "2026-08-25T21:28:29Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![elfed](https://avatars.discourse-cdn.com/v4/letter/e/73ab20/32.png) [@elfed](https://universal-blue.discourse.group/u/elfed)\
**Post date:** [August 25, 2026, 9:28pm UTC](https://universal-blue.discourse.group/t/selinux-problems-with-libvirt-tpm-in-latest-version-of-bazzite/12419/1 "2026-08-25T21:28:29Z")

</div>

In latest version of bazzite, I cant launch a windows 11 VM that previously worked fine (as in, worked fine up until a few days ago). I get a bunch of selinux denials related to the software TPM module:

type=AVC msg=audit(1787692573.830:614): avc: denied { setattr } for pid=25904 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=1  
type=AVC msg=audit(1787692573.831:615): avc: denied { write } for pid=33778 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=1  
type=AVC msg=audit(1787692573.831:616): avc: denied { relabelfrom } for pid=33778 comm=“rpc-virtqemud” name=“tpm2” dev=“nvme0n1p6” ino=111059 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:virt\_var\_lib\_t:s0 tclass=dir permissive=1  
type=AVC msg=audit(1787692573.831:617): avc: denied { relabelfrom } for pid=33778 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=1  
type=AVC msg=audit(1787692573.834:618): avc: denied { entrypoint } for pid=33782 comm=“rpc-virtqemud” path=“/usr/bin/swtpm” dev=“overlay” ino=11943 scontext=system\_u:system\_r:svirt\_t:s0:c33,c905 tcontext=system\_u:object\_r:bin\_t:s0 tclass=file permissive=0  
type=AVC msg=audit(1787692573.837:619): avc: denied { relabelto } for pid=33783 comm=“rpc-virtqemud” name=“tpm2” dev=“nvme0n1p6” ino=111059 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:virt\_var\_lib\_t:s0 tclass=dir permissive=1  
type=AVC msg=audit(1787692573.837:620): avc: denied { relabelto } for pid=33783 comm=“rpc-virtqemud” name=“.lock” dev=“nvme0n1p6” ino=111061 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:virt\_var\_lib\_t:s0 tclass=file permissive=1  
type=AVC msg=audit(1787692573.837:621): avc: denied { relabelto } for pid=33783 comm=“rpc-virtqemud” name=“win11-swtpm.log” dev=“nvme0n1p6” ino=110706 scontext=system\_u:system\_r:virtqemud\_t:s0 tcontext=system\_u:object\_r:var\_log\_t:s0 tclass=file permissive=1

I believe the issue is related to the labelling of the software TPM module. if i disable or put selinux in permissive, it works fine. It worked fine until a few days ago, so I assume this is an issue with the latest update.

Im unsure how to fix this - if i autdit2allow those denials, will that survive a reboot on bazzite? Or should this be fixed in the selinux policies applied to the system, and so I should just switch to permissive for now until it gets fixed upstream?

---

<div class="post-metadata">

**Author:** ![elfed](https://avatars.discourse-cdn.com/v4/letter/e/73ab20/32.png) [@elfed](https://universal-blue.discourse.group/u/elfed)\
**Post date:** [August 27, 2026, 8:59pm UTC](https://universal-blue.discourse.group/t/selinux-problems-with-libvirt-tpm-in-latest-version-of-bazzite/12419/2 "2026-08-27T20:59:33Z")

</div>

Updated bazzite to latest and issue seems to be resolved now.