On Wed, Jul 15, 2026 at 06:25:07PM +0200, lejeczek via Users wrote:
Hi guys.
Having a domain like so: .... <os firmware='efi'> <type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type> <firmware> <feature enabled='yes' name='enrolled-keys'/> <feature enabled='yes' name='secure-boot'/> </firmware> <loader readonly='yes' secure='yes' type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader> <nvram template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd' templateFormat='raw' format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram> ... <seclabel type='dynamic' model='selinux' relabel='yes'> <label>system_u:system_r:svirt_t:s0</label> <imagelabel>system_u:object_r:svirt_image_t:s0</imagelabel> </seclabel> <seclabel type='dynamic' model='dac' relabel='yes'> <label>+107:+107</label> <imagelabel>+107:+107</imagelabel> </seclabel>
_seclabels_ are from virt-install - I'd presume this mandatory/default
Any such domain - using NVRAM - fails to start with SELinux logging: ... virtqemud[1340835]: internal error: child reported (status=125): Requested operation is not valid: Setting different SELinux label on /var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd which is already in use ...
Libvirt uses xattrs to record metadata about what VM a file is associated with. It sounds like an unclean shutdown/crash left stale data around. You can likely see it with "getfattr -m - /path/to/file" $ getfattr -m - -d /var/lib/libvirt/images/rhel92.qcow2 getfattr: Removing leading '/' from absolute path names # file: var/lib/libvirt/images/rhel92.qcow2 security.selinux="system_u:object_r:svirt_image_t:s0:c43,c354" trusted.libvirt.security.dac="+0:+0" trusted.libvirt.security.ref_dac="1" trusted.libvirt.security.ref_selinux="1" trusted.libvirt.security.selinux="system_u:object_r:virt_image_t:s0" trusted.libvirt.security.timestamp_dac="1779358028" trusted.libvirt.security.timestamp_selinux="1779358028"
Do you have any thoughts on how to "fix" it?
If you're sure there's no other running QEMU process still using the file, then purging the 'trusted.libvirt.security' attributes would likely fix it With regards, Daniel -- |: https://berrange.com ~~ https://hachyderm.io/@berrange :| |: https://libvirt.org ~~ https://entangle-photo.org :| |: https://pixelfed.art/berrange ~~ https://fstop138.berrange.com :|