F44 update mislabels swtpm - unable to run VMs

guiltydoggy · August 4, 2026, 2:43pm

I updated my Kinoite system today from 20260731.0 to 20260804.0. I have libvirt VMs that have a virtual TPM. When booting them in 2026731.0, they launch fine. But after updating to 20260804.0, they fail to launch with the following error:

Error message

Error starting domain: operation failed: swtpm died and reported: libvirt:  error : cannot execute binary /usr/bin/swtpm: Permission denied


Traceback (most recent call last):
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 67, in cb_wrapper
    callback(asyncjob, *args, **kwargs)
    ~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtManager/asyncjob.py", line 101, in tmpcb
    callback(*args, **kwargs)
    ~~~~~~~~^^^^^^^^^^^^^^^^^
  File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn
    ret = fn(self, *args, **kwargs)
  File "/usr/share/virt-manager/virtManager/object/domain.py", line 1446, in startup
    self._backend.create()
    ~~~~~~~~~~~~~~~~~~~~^^
  File "/usr/lib64/python3.14/site-packages/libvirt.py", line 1395, in create
    raise libvirtError('virDomainCreate() failed')
libvirt.libvirtError: operation failed: swtpm died and reported: libvirt:  error : cannot execute binary /usr/bin/swtpm: Permission denied

Looking at swtpm, it looks like it has changed its label from swtpm_exec_t to bin_t. The rules don’t seem to exist in the updated deployment.

20260731.0 Details

yosuke@fedora-pc  ~  rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
fedora:fedora/44/x86_64/kinoite
Version: 44.20260804.0 (2026-08-04T00:34:22Z)
BaseCommit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da
GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
Diff: 43 upgraded, 1 removed, 1 added
RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44
LayeredPackages: doas libvirt neovim tmux virt-manager zsh

● fedora:fedora/44/x86_64/kinoite
Version: 44.20260731.0 (2026-07-31T00:35:32Z)
BaseCommit: d77b22e2e5fe7d0504f46cdf7772f17a250998f887307e9b46231e31c777663d
GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
RemovedBasePackages: firefox firefox-langpacks 153.0-3.fc44
LayeredPackages: doas libvirt neovim tmux virt-manager zsh

AvailableUpdate:
Version: 44.20260804.0 (2026-08-04T00:34:22Z)
Commit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da
GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
SecAdvisories: 3 important
Diff: 45 upgraded, 1 removed, 1 added

yosuke@fedora-pc  ~  /bin/ls -lZ /usr/bin/swtpm
-rwxr-xr-x. 1 root root system_u:object_r:swtpm_exec_t:s0 42200 Dec 31  1969 /usr/bin/swtpm

yosuke@fedora-pc  ~  doas semodule -l | grep swtpm
swtpm
swtpm_libvirt
swtpm_svirt

yosuke@fedora-pc  ~  doas ls -l /etc/selinux/targeted/active/modules/200
total 0
drwx------. 1 root root 28 Jul 31 05:45 container
drwx------. 1 root root 28 Jul 31 05:45 flatpak
drwx------. 1 root root 28 Jul 31 05:45 mariadb-plugin-cracklib-password-check
drwx------. 1 root root 28 Jul 31 05:45 mysql
drwx------. 1 root root 28 Jul 31 05:45 nbdkit
drwx------. 1 root root 28 Jul 31 05:45 passt
drwx------. 1 root root 28 Jul 31 05:45 passt-repair
drwx------. 1 root root 28 Jul 31 05:45 pasta
drwx------. 1 root root 28 Jul 31 05:45 pesto
drwx------. 1 root root 28 Jul 31 05:45 smartmon
drwx------. 1 root root 28 Jul 31 05:45 swtpm
drwx------. 1 root root 28 Jul 31 05:45 swtpm_libvirt
drwx------. 1 root root 28 Jul 31 05:45 swtpm_svirt

20260804.0 Details

yosuke@fedora-pc  ~  rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● fedora:fedora/44/x86_64/kinoite
Version: 44.20260804.0 (2026-08-04T00:34:22Z)
BaseCommit: 2bc50ea2b4f99ba841d389455d13f7b844c40307c54d9b9f0808f08b639713da
GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44
LayeredPackages: doas libvirt neovim tmux virt-manager zsh

fedora:fedora/44/x86_64/kinoite
Version: 44.20260731.0 (2026-07-31T00:35:32Z)
BaseCommit: d77b22e2e5fe7d0504f46cdf7772f17a250998f887307e9b46231e31c777663d
GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
RemovedBasePackages: firefox firefox-langpacks 153.0-3.fc44
LayeredPackages: doas libvirt neovim tmux virt-manager zsh

yosuke@fedora-pc  ~  /bin/ls -lZ /usr/bin/swtpm
-rwxr-xr-x. 1 root root system_u:object_r:bin_t:s0 42200 Dec 31  1969 /usr/bin/swtpm

yosuke@fedora-pc  ~  doas semodule -l | grep swtpm

✘ yosuke@fedora-pc  ~  doas ls -l /etc/selinux/targeted/active/modules/200
total 0
drwx------. 1 root root 28 Aug  4 06:04 container
drwx------. 1 root root 28 Aug  4 06:04 flatpak
drwx------. 1 root root 28 Aug  4 06:04 mariadb-plugin-cracklib-password-check
drwx------. 1 root root 28 Aug  4 06:04 mysql
drwx------. 1 root root 28 Aug  4 06:04 nbdkit
drwx------. 1 root root 28 Aug  4 06:04 passt
drwx------. 1 root root 28 Aug  4 06:04 passt-repair
drwx------. 1 root root 28 Aug  4 06:04 pasta
drwx------. 1 root root 28 Aug  4 06:04 pesto
drwx------. 1 root root 28 Aug  4 06:04 smartmon

Updated components

 yosuke@fedora-pc  ~  rpm-ostree db diff
ostree diff commit from: rollback deployment (4daccdbc817d6addfb06dbf430a5cc4fa9891e264f71de067089fb8dee0a9d09)
ostree diff commit to:   booted deployment (fdeb8e33bfe3ddfc9b982206c40c579786921699b35f7b643281f2269b63510f)
Upgraded:
  audit 4.1.4-1.fc44 -> 4.2.1-1.fc44
  audit-libs 4.1.4-1.fc44 -> 4.2.1-1.fc44
  audit-rules 4.1.4-1.fc44 -> 4.2.1-1.fc44
  bootc 1.16.4-1.fc44 -> 1.16.6-1.fc44
  checkpolicy 3.10-1.fc44 -> 3.11-1.fc44
  curl 8.18.0-7.fc44 -> 8.18.0-8.fc44
  enchant2 2.8.18-1.fc44 -> 2.8.19-2.fc44
  ffmpeg-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  fuse-overlayfs 1.16-2.fc44 -> 1.17-1.fc44
  hfsutils 3.2.6-53.fc42 -> 3.2.6-57.fc44
  hwdata 0.409-1.fc44 -> 0.410-1.fc44
  libavcodec-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libavdevice-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libavfilter-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libavformat-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libavutil-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libcurl-minimal 8.18.0-7.fc44 -> 8.18.0-8.fc44
  libselinux 3.10-1.fc44 -> 3.11-1.fc44
  libselinux-utils 3.10-1.fc44 -> 3.11-1.fc44
  libsemanage 3.10-1.fc44 -> 3.11-1.fc44
  libsepol 3.10-1.fc44 -> 3.11-1.fc44
  libswresample-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libswscale-free 8.1.2-1.fc44 -> 8.1.2-4.fc44
  libva-intel-media-driver 26.1.5-1.fc44 -> 26.2.4-1.fc44
  nspr 4.39.0-2.fc44 -> 4.39.0-3.fc44
  nss 3.125.0-1.fc44 -> 3.126.0-1.fc44
  nss-softokn 3.125.0-1.fc44 -> 3.126.0-1.fc44
  nss-softokn-freebl 3.125.0-1.fc44 -> 3.126.0-1.fc44
  nss-sysinit 3.125.0-1.fc44 -> 3.126.0-1.fc44
  nss-util 3.125.0-1.fc44 -> 3.126.0-1.fc44
  openxr-libs 1.1.61-1.fc44 -> 1.1.62-1.fc44
  policycoreutils 3.10-4.fc44 -> 3.11-2.fc44
  policycoreutils-python-utils 3.10-4.fc44 -> 3.11-2.fc44
  python3-audit 4.1.4-1.fc44 -> 4.2.1-1.fc44
  python3-libselinux 3.10-1.fc44 -> 3.11-1.fc44
  python3-libsemanage 3.10-1.fc44 -> 3.11-1.fc44
  python3-policycoreutils 3.10-4.fc44 -> 3.11-2.fc44
  python3-regex 2026.5.9-1.fc44 -> 2026.7.19-1.fc44
  python3-setools 4.6.0-5.fc44 -> 4.6.0-6.fc44
  tree-sitter-cli 0.26.9-2.fc44 -> 0.26.11-1.fc44
  xen-libs 4.21.1-4.fc44 -> 4.21.2-1.fc44
  xen-licenses 4.21.1-4.fc44 -> 4.21.2-1.fc44
  zchunk-libs 1.5.1-4.fc44 -> 1.5.4-1.fc44
Removed:
  tcl8-1:8.6.17-2.fc44.x86_64
Added:
  libklvanc-1.6.0-4.fc44.x86_64

wallmenis · August 4, 2026, 5:41pm

I am adding this comment to say that I too have this issue.

guiltydoggy · August 4, 2026, 5:58pm

Bugzilla filed: 2511086 – SELinux update mislabels swtpm and causes VMs to be unable to launch

guiltydoggy · August 4, 2026, 11:04pm

Patch is in Bodhi: Making sure you're not a bot!

Tested and confirmed to resolve my issue on Kinoite 44.

chillzone · August 5, 2026, 3:06pm

I also can confirm the patch works for both “f44” and f45 after today’s updates.

I thought it might take longer for fedora 45 to push it to 45 but all good here as well.

sudo virsh list
[sudo] password for me: 
 Id   Name     State
------------------------
 4    fedora   running

┌───────────────────>
│~ 
└─> sudo virsh list --state-shutoff
 Id   Name        State
----------------------------
 -    archlinux   shut off

didier · August 6, 2026, 5:40am

Hello,

I am running fedora silverblue 44 and the last updates killed brought the same problem. I have the same error messages.

I am a newbie in fedora silverblue, how can I apply this fix on silverblue?
Thank you very much!
Didier

wallmenis · August 6, 2026, 5:49am

The patch is being on the testing phase
https://bodhi.fedoraproject.org/updates/FEDORA-2026-aa55df3280

guiltydoggy · August 6, 2026, 1:52pm

Looks like the patch has landed in today’s build. Run rpm-ostree upgrade and reboot and it should be fixed.

chillzone · August 6, 2026, 3:04pm

Indeed, but this will show only for F45:

dnf info swtpm swtpm-libs
Updating and loading repositories:
Repositories loaded.
Installed packages
Name            : swtpm
Epoch           : 0
Version         : 0.10.1
Release         : 4.fc44
Architecture    : src
Installed size  : 427.5 KiB
From repository : @commandline
Summary         : TPM Emulator
URL             : https://github.com/stefanberger/swtpm
License         : BSD-3-Clause
Description     : TPM emulator built on libtpms providing TPM functionality for QEMU VMs
Vendor          : Fedora Project

Available packages
Name           : swtpm
Epoch          : 0
Version        : 0.10.1
Release        : 6.fc45
Architecture   : x86_64
Download size  : 33.9 KiB
Installed size : 53.0 KiB
Source         : swtpm-0.10.1-6.fc45.src.rpm
Repository     : rawhide
Summary        : TPM Emulator
URL            : https://github.com/stefanberger/swtpm
License        : BSD-3-Clause
Description    : TPM emulator built on libtpms providing TPM functionality for QEMU VMs
Vendor         : Fedora Project

Name           : swtpm-libs
Epoch          : 0
Version        : 0.10.1
Release        : 6.fc45
Architecture   : i686
Download size  : 68.9 KiB
Installed size : 131.3 KiB
Source         : swtpm-0.10.1-6.fc45.src.rpm
Repository     : rawhide
Summary        : Private libraries for swtpm TPM emulators
URL            : https://github.com/stefanberger/swtpm
License        : BSD-3-Clause
Description    : A private library with callback functions for libtpms based swtpm TPM emulator
Vendor         : Fedora Project

Name           : swtpm-libs
Epoch          : 0
Version        : 0.10.1
Release        : 6.fc45
Architecture   : x86_64
Download size  : 64.1 KiB
Installed size : 136.2 KiB
Source         : swtpm-0.10.1-6.fc45.src.rpm
Repository     : rawhide
Summary        : Private libraries for swtpm TPM emulators
URL            : https://github.com/stefanberger/swtpm
License        : BSD-3-Clause
Description    : A private library with callback functions for libtpms based swtpm TPM emulator
Vendor         : Fedora Project

I upgraded my F44 install for testing F45, so F44 will show a diffrent version #

guiltydoggy · August 6, 2026, 4:03pm

On my Kinoite 44 system, it looks like the updated version was installed with today’s update:

 yosuke@fedora-pc  ~  doas semodule -l | grep swtpm
swtpm
swtpm_libvirt
swtpm_svirt

 yosuke@fedora-pc  ~  rpm -qa | grep swtpm
swtpm-libs-0.10.1-4.fc44.x86_64
swtpm-0.10.1-4.fc44.x86_64
swtpm-selinux-0.10.1-4.fc44.noarch
swtpm-tools-0.10.1-4.fc44.x86_64

 yosuke@fedora-pc  ~  rpm-ostree status
State: idle
AutomaticUpdates: stage; rpm-ostreed-automatic.timer: no runs since boot
Deployments:
● fedora:fedora/44/x86_64/kinoite
                  Version: 44.20260806.0 (2026-08-06T00:50:47Z)
               BaseCommit: ed735b2926fb33620d26763149ceb9c772d9bdcc0796361de027ca339d1bb419
             GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
      RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44
          LayeredPackages: doas libvirt neovim tmux virt-manager zsh

  fedora:fedora/44/x86_64/kinoite
                  Version: 44.20260806.0 (2026-08-06T00:50:47Z)
               BaseCommit: ed735b2926fb33620d26763149ceb9c772d9bdcc0796361de027ca339d1bb419
             GPGSignature: Valid signature by 36F612DCF27F7D1A48A835E4DBFCF71C6D9F90A6
      RemovedBasePackages: firefox firefox-langpacks 153.0.1-1.fc44
          LayeredPackages: doas libvirt neovim tmux virt-manager zsh
            LocalPackages: swtpm-0.10.1-4.fc44.x86_64 swtpm-libs-0.10.1-4.fc44.x86_64 swtpm-selinux-0.10.1-4.fc44.noarch swtpm-tools-0.10.1-4.fc44.x86_64

Topic		Replies	Views
Creating new VM with TPM using virt-manager results in SELinux-related error Ask Fedora selinux	16	2231	May 2, 2024
There are some issues with simulating TPM Ask Fedora kvm , libvirt , qemukvm	1	679	April 26, 2024
Fedora 42 upgrade - failed to login Ask Fedora networkmanager , coreos , f42	9	531	May 8, 2025
Swtpm and/or selinux and/or ? error preventing VM install under UEFI with Cockpit (or Virt-Manager) Ask Fedora help , cockpit , server , f41	16	887	February 28, 2025
Upgrade failes for F32, prevents upgrade to f33 Ask Fedora f32	13	1087	June 2, 2021

F44 update mislabels swtpm - unable to run VMs

Related topics