New comment by sernkut on void-packages repository https://github.com/void-linux/void-packages/issues/31904#issuecomment-901483813 Comment: This is caused by `virt-aa-manager` as it's trying to automatically generate the AppArmor profile on VM statup. `virt-aa-manager` disallows some paths in generated AppArmor profiles wich can be found here [`src/security/virt-aa-helper.c:454-490:valid_path()`](https://github.com/libvirt/libvirt/blob/master/src/security/virt-aa-helper.c#L454-L490) I fixed this by looking at `/usr/share/qemu/firmware/60-edk2-x86_64.json` and then copied the executable and nvram-template files to `/usr/share/ovmf` and finally created a copy of the json file with a new name eg. `60-edk2-x86_64-custom.json` and updated the paths in this new file. Also i'm sorry for creating a extra issue.