Unable to create a new VM using virt-manager

[broomstickengine]

Describe the bug

Upon configuring the VM and clicking "finish", I receive the following error:

Unable to complete install: 'internal error: Could not run '/usr/bin/swtpm_setup'. exitstatus: 1; Check error log '/var/log/swtpm/libvirt/qemu/win11-swtpm.log' for details.'

The log file shows the following:

Starting vTPM manufacturing as tss:tss @ Wed 20 Dec 2023 05:58:44 PM MST
Successfully created RSA 2048 EK with handle 0x81010001.
Invoking /usr/bin/swtpm_localca --type ek --ek a4528233fe080e9465da3f2904bf66be1da0eadddd515a238e006f42af472cd0d34e844fb07a030045ca9c89935b5cc0dfbb18c17def4dcb084afcd44be2ebbc9356e84a9c2876f6e4ed5e1000ac1ec8e6bba8b0631e7a3206b8976a6ac2940795a09366f0450272dbec4005b28e349890b6a7328d36964db5c1c84fd8b524678820c9b9ac3d620f570bd270607b46402798ef56e7d205f4d6340bb414529b4a62f4e0ff3f5325ae18a6f391c28126f97e200d544ce00596d1c2ed63445228b8321b8b8ef572afa78b26c4aeb65af250362cc16214835a19eacd5e77f9ee56dfb615f45e3f6358b63ef87b23c50de7a565546194346c4cca5c324144374b9ee5 --dir /tmp/swtpm_setup.certs.0728F2 --logfile /var/log/swtpm/libvirt/qemu/win11-swtpm.log --vmid win11:91eee591-fb2d-471c-bf66-5c8d9ddd05d1 --tpm-spec-family 2.0 --tpm-spec-level 0 --tpm-spec-revision 164 --tpm-manufacturer id:00001014 --tpm-model swtpm --tpm-version id:20191023 --tpm2 --configfile /etc/swtpm-localca.conf --optsfile /etc/swtpm-localca.options
Creating swtpm-localca dir '/var/lib/swtpm-localca'.
Could not create directory for 'statedir': Permission denied
swtpm_localca exit with status 1:
An error occurred. Authoring the TPM state failed.
Error getting next filename: No child processes
Ending vTPM manufacturing @ Wed 20 Dec 2023 05:58:44 PM MST

What did you expect to happen?

I expected virt-manager to allow me to install the VM without any errors.

Output of rpm-ostree status

● ostree-image-signed:docker://ghcr.io/ublue-os/bluefin-dx:latest
                   Digest: sha256:82de0bd2205d7dfa042639438d8050403721b5b56450de28772a4dd508b096c0
                  Version: 39.20231215.0 (2023-12-17T16:51:17Z)

Extra information or context

No response

[castrojo]

I wonder if having the VMs stored in a writeable spot (like your home directory) would work?

[bketelsen]

is your user a member of libvirt?

[m2Giles]

I think you posted this on reddit as well. It was answered there.

https://www.reddit.com/r/Fedora/comments/18nhfwy/virtmanager_isnt_working_on_silverblue_39/

This is your error.

Creating swtpm-localca dir '/var/lib/swtpm-localca'.
Could not create directory for 'statedir': Permission denied

Create that directory and make sure the user TSS has ownership of it. Libvirt cannot create the directory and then once create tss (the user for tpm activities) needs access to it for actually writing stuff to it.

You will then run into issues with swtpm not having the right selinux labels.

See ostreedev/ostree-rs-ext#510 (comment) for a workaround.

[broomstickengine]

I think you posted this on reddit as well. It was answered there.

https://www.reddit.com/r/Fedora/comments/18nhfwy/virtmanager_isnt_working_on_silverblue_39/

This is your error.

Creating swtpm-localca dir '/var/lib/swtpm-localca'.
Could not create directory for 'statedir': Permission denied

Create that directory and make sure the user TSS has ownership of it. Libvirt cannot create the directory and then once create tss (the user for tpm activities) needs access to it for actually writing stuff to it.

You will then run into issues with swtpm not having the right selinux labels.

See ostreedev/ostree-rs-ext#510 (comment) for a workaround.

Thank you. Your workaround successfully worked for me.

As you previously mentioned in your post, I'd be curious what the downsides are for this workaround.

[m2Giles]

This should be completed with #764.

[broomstickengine]

This should be completed with #764.

Just to be clear, if this issue is officially fixed, then is it available for me to update my existing installation yet? Or do I need to wait for
Bluefin 40?

[m2Giles]

The fix was merged. I can confirm it's on the image built 20240101.

[broomstickengine]

The fix was merged. I can confirm it's on the image built 20240101.

That’s great to hear. Do I just run the following to pull in the change?

rpm-ostree upgrade

[m2Giles]

You can run just update which will update basically everything or if you only need the new image your command will do exactly that. In fact it may already be on your system and are just a reboot away.

[broomstickengine]

You can run just update which will update basically everything or if you only need the new image your command will do exactly that. In fact it may already be on your system and are just a reboot away.

Awesome, thank you so much for your help! I appreciate all the work that you and all the other devs are doing to make this project shine. ✌️