Last Modified: Aug 01, 2026
Affected Product(s):
F5OS F5OS-A, Install/Upgrade
Known Affected Versions:
F5OS-A 1.8.0, F5OS-A 1.8.1, F5OS-A 1.8.2, F5OS-A 1.8.3, F5OS-A 1.8.4, F5OS-A 1.8.4-HR1
Opened: May 28, 2026 Severity: 2-Critical
After upgrading to F5OS-A 1.8.4, superuser-bash users receive "Permission denied" when running virtctl to connect to tenant consoles. The error occurs both when running as the superuser directly and after running sudo su to root. SELinux audit logs show AVC denials for execute on /usr/local/bin/virtctl with source context staff_u:sysadm_r:sysadm_t and target context var_t.
Operators who previously used superuser-bash access to manage tenant consoles via virtctl can no longer do so. It breaks the primary workflow for superuser-bash users to access the tenant console.
1. Configure an rSeries appliance with F5OS-A-1.8.x-EHF. 2. Enable superuser-bash-access: system aaa authentication config superuser-bash-access true 3. Create a local user in the superuser role: $ system aaa authentication users user <name> config role admin ; top $ system aaa authentication roles role superuser config users <name> $ commit $ system aaa authentication users user <name> config set-password $ system aaa authentication users user <name> config last-change 2026-05-20 $ commit and-quit 4. Log in to the device with the above-created super user, then run the commands below, and observe the failure patterns ex: ssh <super-user>@<mgmt-ip> $ sudo su $ virtctl console <tenant-VMI-Name>
Log into the system as root and change the SELinux context for /usr/local/bin/virtctl: semanage fcontext -a -f f -t bin_t '/var/usrlocal/bin/virtctl' restorecon -F /var/usrlocal/bin/virtctl
None