Hi guys.
Having a domain like so:
....
<os firmware='efi'>
<type arch='x86_64' machine='pc-q35-rhel10.2.0'>hvm</type>
<firmware>
<feature enabled='yes' name='enrolled-keys'/>
<feature enabled='yes' name='secure-boot'/>
</firmware>
<loader readonly='yes' secure='yes'
type='pflash'>/usr/share/edk2/ovmf/OVMF_CODE.secboot.fd</loader>
<nvram
template='/usr/share/edk2/ovmf/OVMF_VARS.secboot.fd'
templateFormat='raw'
format='raw'>/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd</nvram>
...
<seclabel type='dynamic' model='selinux' relabel='yes'>
<label>system_u:system_r:svirt_t:s0</label>
<imagelabel>system_u:object_r:svirt_image_t:s0</imagelabel>
</seclabel>
<seclabel type='dynamic' model='dac' relabel='yes'>
<label>+107:+107</label>
<imagelabel>+107:+107</imagelabel>
</seclabel>
_seclabels_ are from virt-install - I'd presume this
mandatory/default
Any such domain - using NVRAM - fails to start with SELinux
logging:
...
virtqemud[1340835]: internal error: child reported
(status=125): Requested operation is not valid: Setting
different SELinux label on
/var/lib/libvirt/qemu/nvram/ubusrv2_VARS.fd which is already
in use
...
Do you have any thoughts on how to "fix" it?
I think I've seen this/similar issue a few years ago - I
might have even filed a BZ.
Also - I got a number of rpm updates among which is qemu to
version 10.1.0-24 - prior to that my VMs worked a ok, on
Centos 10.
Anybody with similar experience?
many thanks, L.
