Comment 27 for bug 1815910

Since quite often hot/clodplug is different I was looking into that as well:

$ cat vhost-scsi.xml
    <hostdev mode='subsystem' type='scsi_host' managed='no'>
      <source protocol='vhost' wwpn='naa.50014054d8284df8'/>
    </hostdev>
$ virsh attach-device disco-luks vhost-scsi.xml
error: internal error: cannot update AppArmor profile 'libvirt-0804001f-c45f-4345-994f-9fec048e822e'

$ cat vhost-vsock.xml
    <vsock model='virtio'>
      <cid auto='yes'/>
    </vsock>
error: internal error: unable to execute QEMU command 'getfd': No file descriptor supplied via SCM_RIGHTS

Here we go. This time not that it would be added later by virt-aa-helper.
Just the late passing of FDs breaks it.
The fix for vhost-vsock is the same that we do for vhost-net - scsi is different thou.