On 01/17/2017 02:13 PM, Marc Hartmayer wrote: I wouldn't guess from the error message that qemu is getting EPERM. Anyway, the SELinux issue is fixed in -rc2: commit 93a062c3b293685024d60e841a37e93e303f4943 Author: Michal Privoznik <mprivozn(a)redhat.com&gt; AuthorDate: Fri Jan 13 10:03:23 2017 +0100 Commit: Michal Privoznik <mprivozn(a)redhat.com&gt; CommitDate: Fri Jan 13 14:45:52 2017 +0100 qemu: Copy SELinux labels for namespace too When creating new /dev/* for qemu, we do chown() and copy ACLs to create the exact copy from the original /dev. I though that copying SELinux labels is not necessary as SELinux will chose the sane defaults. Surprisingly, it does not leaving namespace with the following labels: crw-rw-rw-. root root system_u:object_r:tmpfs_t:s0 random crw-------. root root system_u:object_r:tmpfs_t:s0 rtc0 drwxrwxrwt. root root system_u:object_r:tmpfs_t:s0 shm crw-rw-rw-. root root system_u:object_r:tmpfs_t:s0 urandom As a result, domain is unable to start: error: internal error: process exited while connecting to monitor: Error in GnuTLS initialization: Failed to acquire random data. qemu-kvm: cannot initialize crypto: Unable to initialize GNUTLS library: Failed to acquire random data. The solution is to copy the SELinux labels as well. Reported-by: Andrea Bolognani <abologna(a)redhat.com&gt; Signed-off-by: Michal Privoznik <mprivozn(a)redhat.com&gt; My namespace patches should not clash with this as this isn't a device from /dev/*. In the namespace, it's just /dev that is different to the parent namespace. So anything else (e.g. under /tmp) is "shared" with the parent namespace (it is the same mount in fact). You can try and see if this is a namespace caused issue. Just disable the namespaces and retry. If it succeeds with namespaces disabled, the bug indeed is in my namespaces patches. btw: to disable namespaces set: namespaces=[] in /etc/libvirt/qemu.conf Michal