Description of problem:
After hot-plugging same qcow2 file which is the source of bootable disk in VM, creating external snapshot will fail. 

Version-Release number of selected component (if applicable):
kernel-3.10.0-860.el7.x86_64
qemu-kvm-rhev-2.10.0-21.el7.x86_64
libvirt-3.9.0-14.el7.x86_64

How reproducible:
100%

Steps to Reproduce:
Steps:
1. Prepare a shutdown VM with bootable source file as following:
# virsh domstate test4
shut off

# virsh dumpxml test4 |grep "<disk" -A5
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/RHEL-7.5-x86_64-latest.qcow2'/>
      <target dev='hda' bus='ide'/>
      <address type='drive' controller='0' bus='0' target='0' unit='0'/>
    </disk>

2. Prepare a xml file, the source file is same with Step-1.
# cat test4.xml 
    <disk type='file' device='disk'>
      <driver name='qemu' type='qcow2'/>
      <source file='/var/lib/libvirt/images/RHEL-7.5-x86_64-latest.qcow2'/>
      <target dev='hdb' bus='virtio'/>
    </disk>

3. Start VM and hot-plug, the error will raise
# virsh start test4
Domain test4 started

# virsh attach-device test4 test4.xml 
error: Failed to attach device from test4.xml
error: internal error: unable to execute QEMU command '__com.redhat_drive_add': Device 'drive-virtio-disk1' could not be initialized


4. Try to create external snapshot, it will fail
# virsh snapshot-create-as test4 t4s1 --disk-only --diskspec hda,snapshot=external,file=/tmp/t4s1
error: internal error: unable to execute QEMU command 'transaction': Failed to lock byte 100

Actual results:
As step-4 shows

Expected results:
Creating snapshot should succeed.

Additional info:
The error info in step-3 is related to the following bug:
Bug 1526313 - Improve QEMU lock error info for hot-plugging same qcow2 image file twice in different target to VM

And famz has been checked this issue and provides some debug info as following: 
https://bugzilla.redhat.com/show_bug.cgi?id=1526313#c6
I find that disabling SELinux will fix the issue. My guess is that the error handling logic in libvirt triggered in step 3 has misconfigured the context of the image or something, as a result, a following locking operation when QEMU tries to create the snapshot is rejected by system security policy:

[pid  9863] fcntl(17, F_OFD_SETLK, {l_type=F_RDLCK, l_whence=SEEK_SET, l_start=100, l_len=1}) = -1 EACCES (Permission denied)