On 10/21/22 15:30, Gionatan Danti wrote: This is downright libvirt bug and needs to be fixed. For the libvirt developers on CC: when starting a domain, the QEMU driver sets disk src->path to the actual file path in virDomainDiskTranslateSourcePool() which is called from qemuProcessPrepareDomainStorage(). I'm not sure whether the virt-aa helper sees the translated path in the XML though. So maybe something as trivial as the following might help? diff --git i/src/security/virt-aa-helper.c w/src/security/virt-aa-helper.c index a15971b9bb..f42c3f9a42 100644 --- i/src/security/virt-aa-helper.c +++ w/src/security/virt-aa-helper.c @@ -904,6 +904,7 @@ get_files(vahControl * ctl) #ifdef WITH_STORAGE virDriverLoadModule("storage", "storageRegister", false); #endif + virDomainDiskTranslateSourcePool(ctl->def); for (i = 0; i < ctl->def->ndisks; i++) { virDomainDiskDef *disk = ctl->def->disks[i]; You don't want to translate the path yourself. Libvirt has extensive code for that. These are not the only files where libvirt stores its configuration. For instance, if I'd 'virsh attach-device --live' then this new device won't appear in the XML stored under /etc/libvirt/qemu. I hope we can resolve this libvirt bug soon and you can use fixed version. Michal