Christian: do you think it's worth trying to emulate an actual hardware controller instead of using virtio-scsi in your nested VM test setup? Maybe sys_rawio is not used with virtio-scsi.
Robert: I think sharing the XML definition of a VM triggering the problem would still be useful. You can easily dump it with:
$ virsh list --all # show all the domains
$ virsh dumpxml <domain name>
One question, just to be sure: does the sys_rawio denial prevent the VM from running, or do you see the error but the VM still runs?
Christian: do you think it's worth trying to emulate an actual hardware controller instead of using virtio-scsi in your nested VM test setup? Maybe sys_rawio is not used with virtio-scsi.
Robert: I think sharing the XML definition of a VM triggering the problem would still be useful. You can easily dump it with:
$ virsh list --all # show all the domains
$ virsh dumpxml <domain name>
One question, just to be sure: does the sys_rawio denial prevent the VM from running, or do you see the error but the VM still runs?
Thanks!