Comment 10 for bug 1890858

# Clarify why it happens on your setup #

Binding unix sockets is what the denial is about and there isn't too much in libvirt doing that.

In Focal all these should be systemd socket files that are taken over by the service once started. Maybe in the setup of these is a difference.

If you could attach the full output of the following (if it changes then prior and post triggering the issue).
$ systemctl status $(basename -a $(dpkg -L libvirt-daemon-system | grep -e .socket -e .service | xargs) | xargs)

I'm stabbing in the dark here still, but we need to start somewhere.