Description of problem:

QEMU isn't able to access TPM devices so virtual machines using these as pass-through devices fail to start.

Version-Release number of selected component (if applicable):

selinux-policy-3.13.1-280.fc27.noarch

How reproducible:

Easy to reproduce.

Steps to Reproduce:
1. Create a new Virtual Machine in virt-manager
2. Choose the machine and View -> Details -> Add Hardware -> TPM -> Finish
3. Power on the virtual machine

Actual results:

The machine doesn't start because QEMU fails due not having access to the TPM device. 

Expected results:

The virtual machine should start.

Additional info:

SELinux is preventing qemu-kvm from 'read, write' accesses on the chr_file /dev/tpm0.

*****  Plugin catchall (100. confidence) suggests   **************************

If you believe that qemu-kvm should be allowed read write access on the tpm0 chr_file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qemu-kvm' --raw | audit2allow -M my-qemukvm
# semodule -X 300 -i my-qemukvm.pp


Additional Information:
Source Context                system_u:system_r:svirt_t:s0:c605,c737
Target Context                system_u:object_r:tpm_device_t:s0
Target Objects                /dev/tpm0 [ chr_file ]
Source                        qemu-kvm
Source Path                   qemu-kvm
Port                          <Unknown>
Host                          <Unknown>
Source RPM Packages
Target RPM Packages
Policy RPM                    selinux-policy-3.13.1-280.fc27.noarch
Selinux Enabled               True
Policy Type                   targeted
Enforcing Mode                Enforcing
Host Name                     (deleted)
Platform                      Linux (deleted) 4.13.2-300.fc27.x86_64 #1 SMP Thu
                              Sep 14 17:37:18 UTC 2017 x86_64 x86_64
Alert Count                   1
First Seen                    2017-09-18 10:41:38 CEST
Last Seen                     2017-09-18 10:41:38 CEST
Local ID                      6f6902af-ecdb-428d-8ba0-22f6ee4f677c

Raw Audit Messages
type=AVC msg=audit(1505724098.833:2256): avc:  denied  { read write } for  pid=11351 comm="qemu-kvm" path="/dev/tpm0" dev="devtmpfs" ino=3400 scontext=system_u:system_r:svirt_t:s0:c605,c737 tcontext=system_u:object_r:tpm_device_t:s0 tclass=chr_file permissive=0

It works if the the local policy module mentioned above is generated or if SELinux is changed to permissive mode.