Created attachment 1626289 [details]
vm xml and libvirt daemon log

Description of problem:
As subject

Version-Release number of selected component (if applicable):
qemu-kvm-4.1.0-13.module+el8.1.0+4313+ef76ec61.x86_64
libvirt v5.8.0-179-g67e72053c1

How reproducible:
100%

Steps to Reproduce:
1. Build libvirt source and start daemons:
# make clean && CC=/usr/lib64/ccache/cc ./autogen.sh&&./configure --without-libssh --build=x86_64-redhat-linux-gnu --host=x86_64-redhat-linux-gnu --program-prefix= --disable-dependency-tracking --prefix=/usr --exec-prefix=/usr --bindir=/usr/bin --sbindir=/usr/sbin --sysconfdir=/etc --datadir=/usr/share --includedir=/usr/include --libdir=/usr/lib64 --libexecdir=/usr/libexec --localstatedir=/var --sharedstatedir=/var/lib --mandir=/usr/share/man --infodir=/usr/share/info --with-qemu --without-openvz --without-lxc --without-vbox --without-libxl --with-sasl --with-polkit --with-libvirtd --without-phyp --with-esx --without-hyperv --without-vmware --without-xenapi --without-vz --without-bhyve --with-interface --with-network --with-storage-fs --with-storage-lvm --with-storage-iscsi --with-storage-iscsi-direct --with-storage-scsi --with-storage-disk --with-storage-mpath --with-storage-rbd --without-storage-sheepdog --with-storage-gluster --without-storage-zfs --without-storage-vstorage --with-numactl --with-numad --with-capng --without-fuse --with-netcf --with-selinux --with-selinux-mount=/sys/fs/selinux --without-apparmor --without-hal --with-udev --with-yajl --with-sanlock --with-libpcap --with-macvtap --with-audit --with-dtrace --with-driver-modules --with-firewalld --with-firewalld-zone --without-wireshark-dissector --without-pm-utils --with-nss-plugin '--with-packager=Unknown, 2019-08-19-12:13:01, lab.rhel8.me' --with-packager-version=1.el8 --with-qemu-user=qemu --with-qemu-group=qemu --with-tls-priority= LIBVIRT,SYSTEM --enable-werror --enable-expensive-tests --with-init-script=systemd --without-login-shell && make -j8

# LD_LIBRARY_PATH=./src/.libs/ src/.libs/virtlogd

# LD_PRELOAD="$(find src -name '*.so.*'|tr '\n' ' ')" LIBVIRT_DEBUG=3 LIBVIRT_LOG_FILTERS="1:util 1:qemu 1:security" LIBVIRT_LOG_OUTPUTS="1:file:/tmp/libvirt_daemon.log" src/.libs/libvirtd

2. Prepare a OS image disk. The create a qcow2 with data file and base the new qcow2 on original OS image.
# qemu-img create -b /var/lib/libvirt/images/pc.qcow2 -o backing_fmt=qcow2,data_file=/var/lib/libvirt/images/pc-uplayer.dat,data_file_raw=off /var/lib/libvirt/images/pc-uplayer.qcow2 -f qcow2

3. Start a vm with the uplayer qcow2 file
# virsh dumpxml pc|xmllint --xpath //disk -
<disk type="file" device="disk">
      <driver name="qemu" type="qcow2"/>
      <source file="/var/lib/libvirt/images/pc-uplayer.qcow2"/>
      <target dev="sda" bus="scsi"/>
      <alias name="ua-a"/>
      <address type="drive" controller="0" bus="0" target="0" unit="0"/>
    </disk>
# virsh start pc                           
error: Failed to start domain pc
error: internal error: process exited while connecting to monitor: 2019-10-16T06:11:22.450192Z qemu-kvm: -drive file=/var/lib/libvirt/images/pc-uplayer.qcow2,format=qcow2,if=none,id=drive-ua-a: Could not reopen file: Permission denied

The issue can be reproduced with -blockdev enabled.

Actual results:
As above

Expected results:
No permission deny

Additional info:
See the vm xml and libvirt daemon log in attachment