- Users - libvirt List Archives

Failed to unseal secret using TPM2
by lejeczek 30 Aug '26

30 Aug '26

Hi guys. Do you have some idea what is failing here: Starting virtsecretd.service - libvirt secret daemon... Failed to unseal secret using TPM2: Operation not permitted virtsecretd.service: Failed to set up credentials: Protocol error virtsecretd.service: Failed at step CREDENTIALS spawning /usr/sbin/virtsecretd: Protocol error virtsecretd.service: Main process exited, code=exited, status=243/CREDENTIALS virtsecretd.service: Failed with result 'exit-code'. Failed to start virtsecretd.service - libvirt secret daemon. I'm on Centos with libvirt-12.5.0-3.el10. Only think I can think of - this the only box out of few I have which updated - was EFI update via: -> $ fwupdmgr update After OS reboot this persists. I had to re-enrol LUKS keyslots which use TPM also, but that worked a ok, block devices unlock. Any/all suggestions/thoughts are much appreciated. Thanks.

1 1

Redirect guest COM port to host tty
by bd730c5053df9efb 25 Aug '26

25 Aug '26

Hi all! I have a slackware64-15.0 linux host running libvirt-11.10.0 with qemu 10.2.2 and a windows XP guest. I'm trying to have the gustes COM1 port redirected to the hosts /dev/ttyUSB0 device. I have not found a direct way of doing this in virt-manager since the only options for a serial device are "Output to a file", "Pseudo TTY" or a "UNIX socket". I have managed to modify the domains XML adding the following > <commandline xmlns:qemu='http://libvirt.org/schemas/domain/qemu/1.0'> > <arg value='-chardev'/> > <arg value='serial,path=/dev/ttyUSB0,id=hostserial0'/> > <arg value='-device'/> > <arg value='pci-serial,chardev=hostserial0'/> > </commandline> When I start the VM with this I get an error that says > Could not open '/dev/ttyUSB0': Operation not permitted I checked the device's permissions which are u+rw,g+rw and qemu is being executed with root permissions, I added o+rw to /dev/ttyUSB0 just in case but got the same error. I also tried with /dev/tty0 but got the same error. Thanks in advance! Best regards, Dave. Sent with Proton Mail secure email.

2 2

Libvirt/sanlock doesn't lock after a migration then trashes my disk.
by Matthew Schumacher 20 Aug '26

20 Aug '26

Hello All, Trying to figure out how this is supposed to work. I’m using pacemaker with the ocf:heartbeat:VirtualDomain to manage my virtual machines. If I start a vm on hyper-1 I get locks: > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerNew:298 : driver=0x7f9ba717d020 type=0 nparams=5 params=0x7f9bb00776c0 flags=0x0 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:77 : key=id type=uint value=12 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:77 : key=pid type=uint value=7258 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerLogParams:92 : key=uri type=cstring value=qemu:///system > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerAddResource:324 : lock=0x7f9ba8011280 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerAcquire:342 : lock=0x7f9ba8011280 state='<null>' flags=0x0 action=0 fd=(nil) > 2026-08-20 02:11:14.835+0000: 27626: debug : virLockManagerSanlockAcquire:1007 : Acquiring object 1 > 2026-08-20 02:11:14.845+0000: 27626: debug : virLockManagerSanlockAcquire:1057 : Acquire completed fd=-1 > 2026-08-20 02:11:14.845+0000: 27626: debug : virLockManagerFree:380 : lock=0x7f9ba8011280 If I move that VM to hyper-2 using (virsh --connect=qemu:///system --quiet migrate --live testvm1 qemu+ssh://hyper-2/system) it frees the lock on hyper-1: > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerNew:298 : driver=0x7f9ba717d020 type=0 nparams=5 params=0x7f9bae8744d0 flags=0x0 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:77 : key=id type=uint value=12 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:77 : key=pid type=uint value=7258 > 2026-08-20 02:11:32.485+0000: 27630: debug : virLockManagerLogParams:92 : key=uri type=cstring value=(null) > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerAddResource:324 : lock=0x7f9b94069210 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerInquire:370 : lock=0x7f9b94069210 state=0x7f9b940656b0 flags=0x0 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerSanlockInquire:1148 : pid=7258 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerFree:380 : lock=0x7f9b94069210 > 2026-08-20 02:11:32.486+0000: 27630: debug : virLockManagerPluginGetName:259 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:32.774+0000: 27628: debug : virLockManagerPluginUsesState:267 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f9b6003b080 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerNew:298 : driver=0x7f9ba717d020 type=0 nparams=5 params=0x7f9b9effc790 flags=0x0 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:77 : key=id type=uint value=12 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:77 : key=pid type=uint value=7258 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerLogParams:92 : key=uri type=cstring value=(null) > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerAddResource:324 : lock=0x7f9b60001590 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:33.028+0000: 7260: debug : virLockManagerRelease:358 : lock=0x7f9b60001590 state=0x7f9ba83df8d8 flags=0x0 > 2026-08-20 02:11:33.030+0000: 7260: debug : virLockManagerFree:380 : lock=0x7f9b60001590 Then on hyper-2 I get the lock: > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerPluginGetDriver:275 : plugin=0x7f4694043cd0 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerNew:298 : driver=0x7f46be7e1020 type=0 nparams=5 params=0x7f46db6dc5f0 flags=0x0 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:96 : key=uuid type=uuid value=a5318b9d-48ea-4e06-8591-4f7826b3d0fa > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:89 : key=name type=string value=testvm1 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:77 : key=id type=uint value=3 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:77 : key=pid type=uint value=17070 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerLogParams:92 : key=uri type=cstring value=qemu:///system > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerAddResource:324 : lock=0x7f46cc006fb0 type=0 name=/datastore/vm/testvm1/testvm1.raw nparams=0 params=(nil) flags=0x0 > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerAcquire:342 : lock=0x7f46cc006fb0 state='__LIBVIRT__DISKS__:9ac7be7343fc02b995dcdfe541d0bcbc:/datastore/sanlock/9ac7be7343fc02b995dcdfe541d0bcbc:0:5' flags=0x0 action=0 fd=(nil) > 2026-08-20 02:11:33.057+0000: 3357: debug : virLockManagerSanlockAcquire:1007 : Acquiring object 1 > 2026-08-20 02:11:33.063+0000: 3357: debug : virLockManagerSanlockAcquire:1057 : Acquire completed fd=-1 > 2026-08-20 02:11:33.063+0000: 3357: debug : virLockManagerFree:380 : lock=0x7f46cc006fb0 All is well, but then I call on hyper-1 virsh create /datastore/vm/testvm1/testvm1.xml I get: error: internal error: QEMU unexpectedly closed the monitor (vm='testvm1'): 2026-08-20T02:12:28.413165Z qemu-system-x86_64: -device {"driver":"scsi-hd","bus":"scsi0.0","channel":0,"scsi-id":0,"lun":0,"device_id":"drive-scsi0-0-0-0","drive":"libvirt-2-storage","id":"scsi0-0-0-0","bootindex":2,"write-cache":"on"}: Failed to get "write” lock But in the logs I never see it checking the lock and while the NFS4.2 file system didn’t give it a lock and blocked, it still trashes the VM disk and the VM shows disk errors and mounts read-only. Shouldn’t libvirt/sanlock block this before starting qemu? I’m running libvirt 12.6.0 and qemu 10.2.4 on kernel 6.18.44. I would think these settings would work: # grep lock_ /etc/libvirt/qemu.conf lock_manager = "sanlock" # grep "^[^#]" /etc/libvirt/qemu-sanlock.conf auto_disk_leases = 1 disk_lease_dir = "/datastore/sanlock" host_id = 1 require_lease_for_disks = 1 Thanks!

1 0

File permissions in CIFS network filesystem pool
by Thomas Pircher 19 Aug '26

19 Aug '26

Hi, I'm trying to use a network filesystem pool on a Samba/CIFS share. Libvirt is configured with this pool: <pool type='netfs'> <name>netfs-default</name> <source> <host name='samba.lan.internal'/> <dir path='libvirt/default'/> <format type='cifs'/> </source> <target> <path>/var/lib/libvirt/images/netfs/default</path> <permissions> <mode>0755</mode> <owner>0</owner> <group>0</group> </permissions> </target> </pool> The Samba share is configured with: [libvirt] comment = VM storage pool browseable = yes path = /srv/datastore/samba/libvirt/ writeable = yes public = no guest ok = yes create mask = 0644 directory mask = 0755 force user = shared force group = +shared I can create the pool in virsh. The mounted files are owned by root on the libvirt machine. I can create and edit files as root if I access them via shell. However, libvirt can't start VMs. It fails to open the qcow2 file in the network filesystem pool with "permission denied". The libvirt host is Debian 14 (testing). I can't see any Selinux or Apparmor messages when the failure happens. So I believe the permissions problem is that libvirt tries to access the files as libvirt-qemu user, and this fails. I have tried adding the following snippet to the network fs pool definition, but after saving the pool, these options simply vanish from the network fs pool definition: <fs:mount_opts> <fs:option name='uid=libvirt-qemu'/> <fs:option name='gid=libvirt-qemu'/> </fs:mount_opts> So my question: how can I make this work? I have previously tried using NFSv4, but ran into similar issues. I guess I could make this work by mounting the share outside of libvirt and then point the filesystem pool at the mounted directory. Is there a more elegant way? Thanks, Thomas

2 2

Could not initialize refcount handling - efi ?
by lejeczek 17 Jul '26

17 Jul '26

Hi guys. I cannot start a domain - I wonder if the firmware, in xml, have anything to do with it or issue is different? Jul 17 11:07:41 virtqemud[5658]: Unable to read from monitor: Connection reset by peer Jul 17 11:07:41 virtqemud[5658]: internal error: QEMU unexpectedly closed the monitor (vm='ubusrv2'): 2026-07-17T09:07:41.089484Z qemu-kvm: -blockdev {"node-name":"libvirt-2-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","encrypt":{"format":"luks","key-secret":"libvirt-2-format-encryption-secret0"},"file":"libvirt-2-storage","backing":null}: Could not initialize refcount handling: Input/output error Jul 17 11:07:41 virtqemud[5658]: internal error: process exited while connecting to monitor: 2026-07-17T09:07:41.089484Z qemu-kvm: -blockdev {"node-name":"libvirt-2-format","read-only":false,"discard":"unmap","cache":{"direct":true,"no-flush":false},"driver":"qcow2","encrypt":{"format":"luks","key-secret":"libvirt-2-format-encryption-secret0"},"file":"libvirt-2-storage","backing":null}: Could not initialize refcount handling: Input/output error Above happens with: <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='no' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' type='pflash' format='raw'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> if I do not use EFI than domain starts, no above virtqemud errors, but guest does not boot, expectedly I think - I used to boot a ok. qemu-img shows no issues. Any thoughts? many thanks, L.

2 3

SELinux label with nvram?
by lejeczek 15 Jul '26

15 Jul '26

Hi guys. Having a domain like so: .... <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='yes' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> ... <seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0</label> <imagelabel>system_u:object_r:svirt_image_t:s0</imagelabel> </seclabel> <seclabel type='dynamic' model='dac' relabel='yes'> <label>+107:+107</label> <imagelabel>+107:+107</imagelabel> </seclabel> _seclabels_ are from virt-install - I'd presume this mandatory/default Any such domain - using NVRAM - fails to start with SELinux logging: ... virtqemud[1340835]: internal error: child reported (status=125): Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd which is already in use ... Do you have any thoughts on how to "fix" it? I think I've seen this/similar issue a few years ago - I might have even filed a BZ. Also - I got a number of rpm updates among which is qemu to version 10.1.0-24 - prior to that my VMs worked a ok, on Centos 10. Anybody with similar experience? many thanks, L.

2 1

Extending sVirt to work under qemu:///session
by procmem＠riseup.net 07 Jun '26

07 Jun '26

Hi. I'm a developer with the security and privacy project; WhonixOS and recently we've ported our VMs to make use of the unprivileged qemu:///session mode to be compatible with our host OS that runs in a strict user only mode for daily activities. To my surprise, sVirt is not applied to VMs running in this mode. Inter VM isolation is important for our security model where traffic from an untrusted VM is forcefully tunneled to a trusted gateway VM running Tor to anonymize traffic. We don't want to be in a situation where we have to choose between running in the relatively riskier qemu:///system mode to gain the benefits of sVirt vs sacrificing sVirt inter VM isolation in order to be more compatible with our stricter unprivileged user implementation (which is just safer overall). Please consider extending sVirt to be compatible with qemu session for AppArmor and SELinux

1 0

How to use qemu's blkdebug driver (can't see backing device)
by Ian Pilcher 18 May '26

18 May '26

I am working on a disk burn-in utility, and I'd like to use qemu's blkdebug driver to simulate disk errors. I've added the qemu namespace to my domain. <domain xmlns:qemu="http://libvirt.org/schemas/domain/qemu/1.0" type="kvm"> I've set an alias for my SCSI controller. <controller type="scsi" index="0" model="virtio-scsi"> <driver queues="4" iothread="1"/> <alias name="ua-scsi0"/> <address type="pci" domain="0x0000" bus="0x07" slot="0x00" function="0x0"/> </controller> And I've added the qemu command-line options. <qemu:commandline> <qemu:arg value="-blockdev"/> <qemu:arg value="{"driver":"host_device","filename":"/dev/ram0","node-name":"ram-backend","cache":{"direct":true,"no-flush":false},"discard":"unmap"}"/> <qemu:arg value="-blockdev"/> <qemu:arg value="{"driver":"raw","file":"ram-backend","node-name":"raw-layer"}"/> <qemu:arg value="-blockdev"/> <qemu:arg value="{"driver":"blkdebug","config":"/var/lib/libvirt/images/test.conf","image":"raw-layer","node-name":"debug-disk"}"/> <qemu:arg value="-device"/> <qemu:arg value="scsi-hd,drive=debug-disk,id=scsi0-0-0-1,wwn=0x5000c50030000001,logical_block_size=4096,physical_block_size=4096,bus=ua-scsi0.0,channel=0,scsi-id=0,lun=1"/> </qemu:commandline> When I try to start the VM, I get this. Error starting domain: internal error: process exited while connecting to monitor: 2026-05-15T16:42:46.891789Z qemu-system-x86_64: -blockdev {"driver":"host_device","filename":"/dev/ram0","node-name":"ram-backend","cache":{"direct":true,"no-flush":false},"discard":"unmap"}: Could not open '/dev/ram0': No such file or directory /dev/ram0 definitely exists, and is owned by qemu:qemu. Google Gemini tells me that this is some sort of security feature, but it hasn't been able to suggest a non-janky way to work around it. (To me, changing the global libvirt configuration, rando trigger scripts, or creating some sort of redundant fake drive all fall into the janky category.) Is there really not a clean way to do this? -- ======================================================================== If your user interface is intuitive in retrospect ... it isn't intuitive ========================================================================

2 1

virt-viewer cage full screen tty issues
by Bram Diederik 09 May '26

09 May '26

my .profile is filled with scripts like this. pasted below. it allows a full screen desktop with out any other screens. at a dedicated tty. but it has two issues. If there already is an connection i need to kill everuthing on the tty. And sometimes when i pkill -9 -t tty9 switch from client system the keyboard and mouse dont work. they do work after i rebooted the VM. I dont google stuff deeply and make it my self if i cant find it right away. So i might be doing it wrong. anyway some one can help me with the two issues. ps one bash question. I have an exit. but a right placed ctrl C can break to prompt i dont want that does some one know how i always run the program or exit to logout state. Cheers. bram if [[ "$(tty)" == "/dev/tty10" ]]; then export XDG_RUNTIME_DIR=/run/user/$(id -u)/cage10 while true; do # start agent if needed [ -z "$SSH_AUTH_SOCK" ] && eval "$(ssh-agent -s)" >/dev/null # load key if needed ssh-add -l >/dev/null 2>&1 || ssh-add ~/.ssh/id_rsa mkdir -p "$XDG_RUNTIME_DIR" chmod 700 "$XDG_RUNTIME_DIR" # Run virt-viewer cage -s -- virt-viewer \ --domain-name vision \ -c "qemu+ssh://bram@jack/system?ssh_compression=yes" \ --attach -f \ --auto-resize=always sleep 2 done exit fi

1 0

virt-host-validate should warn about false positives
by therandshow＠gmail.com 04 May '26

04 May '26

virt-host-validate seems to sometimes complain about freezer support on machines with cgroups v2 where it doesn't matter, it also reports lack of devices cgroup if the user isn't running as root. Ideally, it should report N/A on freezer support for cgroups v2 or just PASS because it has validated that it wasn't necessary. Or maybe just have a warning at the bottom, failure for the freezer cgroup only applies to cgroups v1 For devices cgroup, a warning if the user is running not as root and the test fails, you may need elevated privileges to check cgroup 'devices' or something along those lines. Or failing to put it in the output, it would be nice if these facts were more prominent in a troubleshooting page

2 2