SELinux blocked virtproxyd access to io.systemd.Home opentofu

Ask Fedora
,
1

Why would selinx be triggering a block here but only when using opentofu as a user?

time->Mon Aug 10 17:00:05 2026
type=AVC msg=audit(1786399205.391:2636): avc:  denied  { connectto } for  pid=180629 comm="rpc-virtproxyd" path="/run/systemd/userdb/io.systemd.Home" scontext=system_u:system_r:virtproxyd_t:s0 tcontext=system_u:system_r:systemd_homed_t:s0 tclass=unix_stream_socket permissive=0

User has libvirt group and can run virsh commands without issue. This also doesn’t happen when running sudo tofu. Using provider:

terraform {
	required_providers {
		libvirt = {
			source  = "dmacvicar/libvirt"
			version = "~> 0.9.8"
		}
	}
}

provider "libvirt" {
	uri = "qemu:///system"
}

I’m trying to determine if this is actually blocked for a reason or if this is some type of bug.

Fedora Linux 44 (Forty Four) x86_64, selinux-policy-0:44.5-1.fc44.noarch, selinux-policy-targeted-0:44.5-1.fc44.noarch

2

I went ahead and opened a issue under fedora-selinux/selinux-policy since this seems to come from NSS group merge check.

3

This can be allowed by a boolean flag. To enable do

semanage boolean -m --on daemons_enable_cluster_mode

Running the sealert command might have provided that information.

4

While setroubleshoot can recommend using a boolean to allow the needed permissions, it is just a tool and not always worth following. sesearch can be used to show which permissions will be added:

# sesearch -A -b daemons_enable_cluster_mode
allow daemon cluster_conf_t:dir { add_name create getattr ioctl link lock open read remove_name rename reparent rmdir search setattr unlink watch watch_reads write }; [ daemons_enable_cluster_mode ]:True
...17 more lines

The permission will be added in the next selinux-policy build.