SELinux warning: "preventing qemu-system-x86 from using the execmem access on a process."

Ask Fedora
, , , ,
1

Hey there.
I wanted to start up my qemu-vm via Virt Manager as usual, and then the following message popped up:

SELinux is preventing qemu-system-x86 from using the execmem access on a process.

*****  Plugin allow_execmem (91.4 confidence) suggests   *********************

If this issue occurred during normal system operation.
Then this alert could be a serious issue and your system could be compromised.
Do
contact your security administrator and report this issue

*****  Plugin catchall (9.59 confidence) suggests   **************************

If you believe that qemu-system-x86 should be allowed execmem access on processes labeled virtqemud_t by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86
# semodule -X 300 -i my-qemusystemx86.pp

Additional Information:
Source Context                system_u:system_r:virtqemud_t:s0
Target Context                system_u:system_r:virtqemud_t:s0
Target Objects                Unknown [ process ]
Source                        qemu-system-x86
Source Path                   qemu-system-x86
Port                          <Unknown>
Host                          [[REDACTED]]
Source RPM Packages           
Target RPM Packages           
SELinux Policy RPM            selinux-policy-targeted-44.2-1.fc44.noarch
Local Policy RPM              selinux-policy-targeted-44.2-1.fc44.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     [[REDACTED]]
Platform                      Linux [[REDACTED]] 7.0.10-201.fc44.x86_64 #1 SMP
                              PREEMPT_DYNAMIC Wed May 27 13:57:41 UTC 2026
                              x86_64
Alert Count                   2
First Seen                    2026-06-08 10:34:53 CEST
Last Seen                     2026-06-08 10:34:59 CEST
Local ID                      [[REDACTED]]

Raw Audit Messages
type=AVC msg=audit(1780907699.367:1116): avc:  denied  { execmem } for  pid=50976 comm="qemu-system-i38" scontext=system_u:system_r:virtqemud_t:s0 tcontext=system_u:system_r:virtqemud_t:s0 tclass=process permissive=1


Hash: qemu-system-x86,virtqemud_t,virtqemud_t,process,execmem

Iā€™m using Fedora 44 with KDE Plasma on a Dell XPS 9520.
What exactly does this mean? How should I investigate this warning? I donā€™t want to just ignore it, since itā€™s the first time this popped up (unless itā€™s normal, I just ran some updates). Is this a bug that I should report?
Any help is appreciated :3

ā€“ Murphy (they/she)

Edit: I redacted some information that I donā€™t want to have on the internet

2

FWIW, it looks like there are many similar (but not exactly the same) reports that have been filed against SELinux recently.

Edit: There are also some comments in the following bug report that might be relevant to your case:

3

The exact same message (although partly in German) was just posted as a bug there ~3 hours ago. Same confidence rating, etc: 2486183 ā€“ SELinux is preventing qemu-system-x86 from using the 'execmem' accesses on a process.

Thanks, I didnā€™t see it when I looked it up!

Edit: So my guess is that it actually is a bug that got introduced with an update and my system is not compromised

4

indicates there was no effect on functionality, but anyway it should be addressed in the next build.

5

Just ran into this problem, too, after I started virtual machine manager on Fedora 44 KDE and entered my sudo password.

AFAIK, execmem is only required when a program requires a memory to be set to allow both W and X, why does qemu-system want to do that? Also I havenā€™t started any VM yet (only started virtual machine manager), why was qemu-system already started?

6

Since 2.73.3 the ā€œG_REGEX_OPTIMIZEā€ flag was repurposed as a way to request use of the JIT,
and the PCRE2 JIT requires executable memory.

Most libvirt services use of g_regex was passing G_REGEX_OPTIMIZE, so everything related to libvirt gets to try ā€˜execmemā€™, but it is not actually needed, so the permission is dontaudited in the lates policy.

7

Is there a way to disable that JIT? I donā€™t feel at ease using such w^x violating technologies.