When starting libvirt LineageOS ARM virtual machine on Debian 13 ARM I face:

```
Unable to complete install: 'internal error: process exited while connecting to monitor: 2026-08-12T21:47:42.762715Z qemu-system-aarch64: -blockdev {"driver":"file","filename":"/home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img","node-name":"libvirt-3-storage","read-only":true}: Could not open '/home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img': Permission denied'

Traceback (most recent call last):
File "/usr/share/virt-manager/virtManager/asyncjob.py", line 72, in cb_wrapper
callback(asyncjob, *args, **kwargs)
File "/usr/share/virt-manager/virtManager/createvm.py", line 2008, in _do_async_install
installer.start_install(guest, meter=meter)
File "/usr/share/virt-manager/virtinst/install/installer.py", line 695, in start_install
domain = self._create_guest(
^^^^^^^^^^^^^^^^^^^
File "/usr/share/virt-manager/virtinst/install/installer.py", line 637, in _create_guest
domain = self.conn.createXML(initial_xml or final_xml, 0)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/lib/python3/dist-packages/libvirt.py", line 4529, in createXML
raise libvirtError('virDomainCreateXML() failed')
libvirt.libvirtError: internal error: process exited while connecting to monitor: 2026-08-12T21:47:42.762715Z qemu-system-aarch64: -blockdev {"driver":"file","filename":"/home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img","node-name":"libvirt-3-storage","read-only":true}: Could not open '/home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img': Permission denied
```

How to solve this issue, while `/home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img` is 777?
Aug 12, 10:55pm

The error you're encountering is a permission denied issue when QEMU (via libvirt) tries to access the disk image file (lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img). Even though the file has 777 permissions, there are additional layers of security and access control in Linux that could be causing this issue. Here’s how to diagnose and resolve it:

1. Check File Ownership and Permissions

Even with 777 permissions, the ownership of the file and its parent directory matters. QEMU/libvirt typically runs as the libvirt-qemu user and group.

Steps:

  • Ensure the file is owned by the user running the VM (e.g., admin) or the libvirt-qemu group.

  • Run:

    bash
    ls -la /home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img

    If the owner is admin, ensure the libvirt-qemu user/group has access.

  • Fix ownership (if needed):

    bash
    sudo chown admin:libvirt-qemu /home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img

    Or, if you want to allow the libvirt-qemu group to access it:

    bash
    sudo chown :libvirt-qemu /home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img
sudo chmod g+rw /home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img

2. Check Parent Directory Permissions

The parent directory (/home/admin/) must also be accessible to the libvirt-qemu user/group.

Steps:

  • Run: 
    bash
    ls -la /home/admin/
  • Ensure the libvirt-qemu group has execute (x) permission on /home/admin/: 
    bash
    sudo chmod g+x /home/admin/
  • If /home/admin/ is owned by admin, add the libvirt-qemu group to the directory: 
    bash
    sudo chgrp libvirt-qemu /home/admin/
sudo chmod g+rx /home/admin/

3. SELinux or AppArmor Restrictions

If SELinux or AppArmor is enabled, it might block QEMU from accessing files in /home/.

Steps:

  • Check SELinux status:

    bash
    sestatus

    If enabled, temporarily set it to permissive mode to test:

    bash
    sudo setenforce 0

    If the VM starts, SELinux is the issue. You can either:

    • Relabel the file: 
      bash
      sudo chcon -t svirt_image_t /home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img
    • Or add a custom policy (advanced).

  • Check AppArmor status:

    bash
    sudo aa-status

    If AppArmor is enforcing, check the logs for denials:

    bash
    sudo dmesg | grep -i apparmor

    You may need to adjust the AppArmor profile for QEMU.

4. Libvirt Configuration

Libvirt may restrict access to files outside specific directories (e.g., /var/lib/libvirt/images/).

Steps:

  • Option 1: Move the image to the default libvirt directory:

    bash
    sudo mv /home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img /var/lib/libvirt/images/
sudo chown libvirt-qemu:libvirt-qemu /var/lib/libvirt/images/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img

    Update the VM configuration to point to the new path.

  • Option 2: Configure libvirt to allow access to /home/admin/: Edit /etc/libvirt/qemu.conf and add:

    ini
    user = "admin"
group = "libvirt-qemu"

    Then restart libvirt:

    bash
    sudo systemctl restart libvirtd

5. Verify Libvirt User/Group

Ensure the libvirt-qemu user/group exists and is correctly configured:

bash
sudo usermod -aG libvirt-qemu admin
sudo systemctl restart libvirtd

6. Check for Filesystem Mount Options

If /home is on a separate filesystem (e.g., NFS, ext4 with noexec), it might block QEMU.

Steps:

  • Check mount options: 
    bash
    mount | grep /home
  • If you see noexec or nodev, remount with: 
    bash
    sudo mount -o remount,exec /home
    (Permanent fix: update /etc/fstab.)

7. Test with qemu-system-aarch64 Directly

Run QEMU manually to isolate the issue:

bash
qemu-system-aarch64 -m 4G -cpu cortex-a72 -machine virt -blockdev file,filename=/home/admin/lineage-22.1-20250202-UNOFFICIAL-virtio_arm64only.img,node-name=test -device virtio-blk-device,drive=test

If this fails with the same error, the issue is file access. If it works, the problem is libvirt-specific.

8. Debug Libvirt Logs

Check libvirt logs for more details:

bash
sudo journalctl -u libvirtd -f

Or:

bash
sudo tail -f /var/log/libvirt/qemu/*.log

Summary of Likely Fixes

File ownership
chown admin:libvirt-qemu + chmod g+rw
Parent directory permissions
chmod g+x /home/admin/
SELinux
setenforce 0 (test) or chcon -t svirt_image_t
AppArmor
Check dmesg for denials
Libvirt config
Move image to /var/lib/libvirt/images/ or edit qemu.conf
Filesystem mount
Remount /home with exec

Next Steps

  1. Start with ownership and directory permissions (Steps 1–2).
  2. If the issue persists, check SELinux/AppArmor (Step 3).
  3. Test with direct QEMU (Step 7) to isolate the problem.
Aug 12, 10:55pm

This is a shared conversation and may include unverified content that doesn't reflect Mistral AI's views. Login to resume chatting.

Vibe can make mistakes. Check answers. Learn more