The VMKernel log is flooded with "Access denied by vmkernel access control policy" messages

Products

• VMware vSphere ESXi 8.0

Issue/Introduction

In ESXi 8.x, the restrictive security domain policy for the Small Footprint CIM Broker (SFCB)
prevents connection to the /tmp/VMISCSI_MGMT_IPC_PATH socket.

As a result, multiple "Access denied by vmkernel access control policy" messages were reported in the VMKernel logs.

--vmkernel.log
YYYY-MM-DDTHH:MM:SSZ In(###) vmkernel: cpu20:#######)VmkAccess: 106: sfcb-vmware_bas: running in sfcbVmwPluginDom(87): socket = /tmp/VMISCSI_MGMT_IPC_PATH (unix_stream_socket_connect): Access denied by vmkernel access control policy

 

Environment

VMware ESXi 8.0

Resolution

This issue is resolved in the VMware ESXi 8.0 Update 3i (Build 25205845)

Additional Information

VMware ESXi 8.0 Update 3i Release Notes
https://techdocs.broadcom.com/us/en/vmware-cis/vsphere/vsphere/8-0/release-notes/esxi-update-and-patch-release-notes/vsphere-esxi-80u3i-release-notes.html

As a workaround, please disable the "sfcbVmwPluginDom" policy using the command:
# esxcli system secpolicy domain set -l disabled -n sfcbVmwPluginDom