I enabled 3D acceleration and OpenGL to improve performance on my Fedora test VM (to test some non-malicious software before fully installing them into my real system), but I got hit by a popup error “EGL-Initialize failed: EGL_NOT_INITIALIZED” and a SELinux alert, that gave me two options semanage fcontext -a -t virt_image_t '/usr/bin/nvidia-modprobe' & restorecon -v '/usr/bin/nvidia-modprobe' or sudo ausearch -c ‘qemu-system-x86’ --raw | audit2allow -M qemu-nvidia & sudo semodule -X 300 -i qemu-nvidia.pp (which option would be the correct one for this?). I tested both separately, but even so, it kept giving the same error:
Error starting domain: internal error: process exited while connecting to monitor: 2026-09-05T07:31:04.320848Z qemu-system-x86_64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
2026-09-05T07:31:04.320962Z qemu-system-x86_64: egl: render node init failed
Traceback (most recent call last):
File "/usr/share/virt-manager/virtManager/asyncjob.py", line 67, in cb_wrapper
callback(asyncjob, *args, **kwargs)
~~~~~~~~^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/share/virt-manager/virtManager/asyncjob.py", line 101, in tmpcb
callback(*args, **kwargs)
~~~~~~~~^^^^^^^^^^^^^^^^^
File "/usr/share/virt-manager/virtManager/object/libvirtobject.py", line 57, in newfn
ret = fn(self, *args, **kwargs)
File "/usr/share/virt-manager/virtManager/object/domain.py", line 1446, in startup
self._backend.create()
~~~~~~~~~~~~~~~~~~~~^^
File "/usr/lib64/python3.14/site-packages/libvirt.py", line 1395, in create
raise libvirtError('virDomainCreate() failed')
libvirt.libvirtError: internal error: process exited while connecting to monitor: 2026-09-05T07:31:04.320848Z qemu-system-x86_64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
2026-09-05T07:31:04.320962Z qemu-system-x86_64: egl: render node init failed
What can I do? Is it something I did wrong or missed? Or is it a Nvidia driver problem that can’t be solved that easily? Is there any “secure” fix for this?
SELinux Alert:
SELinux is preventing qemu-system-x86 from getattr access on the file /usr/bin/nvidia-modprobe.
***** Plugin qemu_file_image (98.8 confidence) suggests *******************
If nvidia-modprobe is a virtualization target
Then you need to change the label on nvidia-modprobe'
Do
# semanage fcontext -a -t virt_image_t '/usr/bin/nvidia-modprobe'
# restorecon -v '/usr/bin/nvidia-modprobe'
***** Plugin catchall (2.13 confidence) suggests **************************
If you believe that qemu-system-x86 should be allowed getattr access on the nvidia-modprobe file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86
# semodule -X 300 -i my-qemusystemx86.pp
Additional Information:
Source Context system_u:system_r:svirt_t:s0:c215,c1002
Target Context system_u:object_r:xserver_exec_t:s0
Target Objects /usr/bin/nvidia-modprobe [ file ]
Source qemu-system-x86
Source Path qemu-system-x86
Port <Unknown>
Host fedora
Source RPM Packages
Target RPM Packages nvidia-modprobe-610.57.04-1.fc44.x86_64
SELinux Policy RPM selinux-policy-targeted-44.8-1.fc44.noarch
Local Policy RPM selinux-policy-targeted-44.8-1.fc44.noarch
Selinux Enabled True
Policy Type targeted
Enforcing Mode Enforcing
Host Name fedora
Platform Linux fedora 7.1.13-200.fc44.x86_64 #1 SMP
PREEMPT_DYNAMIC Wed Sep 2 13:58:38 UTC 2026
x86_64
Alert Count 1
First Seen 2026-09-05 23:47:51 -03
Last Seen 2026-09-05 23:47:51 -03
Local ID f0232ef7-191a-4c11-bafd-dac296214ba3
Raw Audit Messages
type=AVC msg=audit(1788662871.608:710): avc: denied { getattr } for pid=17861 comm="qemu-system-x86" path="/usr/bin/nvidia-modprobe" dev="nvme0n1p3" ino=11035734 scontext=system_u:system_r:svirt_t:s0:c215,c1002 tcontext=system_u:object_r:xserver_exec_t:s0 tclass=file permissive=0
Hash: qemu-system-x86,svirt_t,xserver_exec_t,file,getattr
Nvidia Driver:
$ cat /proc/driver/nvidia/version
NVRM version: NVIDIA UNIX Open Kernel Module for x86_64 610.57.04 Release Build (dvs-builder@U22-I3-AF05-32-1) Wed Jul 29 02:45:17 UTC 2026
GCC version: gcc version 16.2.1 20260819 (Red Hat 16.2.1-2) (GCC)
Log before SELinux relabel:
Sep 05 23:47:51 fedora systemd-machined[920]: New machine qemu-6-fedora-application-test.
Sep 05 23:47:51 fedora systemd[1]: Started machine-qemu\x2d6\x2dfedora\x2dapplication\x2dtest.scope - Virtual Machine qemu-6-fedora-application-test.
Sep 05 23:47:51 fedora audit[3407]: AUDIT2501 ... class=path path="/dev/dri/by-path/pci-0000:01:00.0-render" rdev=E2:80 acl=rw exe="/usr/bin/virtqemud" ... res=success
Sep 05 23:47:51 fedora audit[17861]: AVC avc: denied { getattr } for pid=17861 comm="qemu-system-x86" path="/usr/bin/nvidia-modprobe" dev="nvme0n1p3" ino=11035734 scontext=system_u:system_r:svirt_t:s0:c215,c1002 tcontext=system_u:object_r:xserver_exec_t:s0 tclass=file permissive=0
Sep 05 23:47:51 fedora virtqemud[3407]: Unable to read from monitor: Connection reset by peer
Sep 05 23:47:51 fedora virtqemud[3407]: internal error: QEMU unexpectedly closed the monitor (vm='fedora-application-test'):
2026-09-06T02:47:51.609478Z qemu-system-x86_64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
2026-09-06T02:47:51.609584Z qemu-system-x86_64: egl: render node init failed
Sep 05 23:47:51 fedora systemd[1]: machine-qemu\x2d6\x2dfedora\x2dapplication\x2dtest.scope: Deactivated successfully.
Sep 05 23:47:51 fedora virtqemud[3407]: internal error: process exited while connecting to monitor:
2026-09-06T02:47:51.609478Z qemu-system-x86_64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
2026-09-06T02:47:51.609584Z qemu-system-x86_64: egl: render node init failed
Sep 05 23:47:51 fedora systemd-machined[920]: Machine qemu-6-fedora-application-test terminated.
Sep 05 23:47:51 fedora audit[3407]: AUDIT2500 ... op=start reason=booted vm="fedora-application-test" ... res=failed
Sep 05 23:47:54 fedora setroubleshoot[4395]: SELinux is preventing qemu-system-x86 from getattr access on the file /usr/bin/nvidia-modprobe.
***** Plugin qemu_file_image (98.8 confidence) suggests *******************
If nvidia-modprobe is a virtualization target
Then you need to change the label on nvidia-modprobe
Do
# semanage fcontext -a -t virt_image_t '/usr/bin/nvidia-modprobe'
# restorecon -v '/usr/bin/nvidia-modprobe'
***** Plugin catchall (2.13 confidence) suggests **************************
If you believe that qemu-system-x86 should be allowed getattr access on the nvidia-modprobe file by default.
Then you should report this as a bug.
You can generate a local policy module to allow this access.
Do
allow this access for now by executing:
# ausearch -c 'qemu-system-x86' --raw | audit2allow -M my-qemusystemx86
# semodule -X 300 -i my-qemusystemx86.pp
Log after applying a SELinux solution (I tried applying the first option):
Sep 05 23:53:23 fedora systemd-machined[920]: New machine qemu-1-fedora-application-test.
Sep 05 23:53:23 fedora systemd[1]: Started machine-qemu\x2d1\x2dfedora\x2dapplication\x2dtest.scope - Virtual Machine qemu-1-fedora-application-test.
Sep 05 23:53:23 fedora audit[18306]: AUDIT2501 ... class=path path="/dev/dri/by-path/pci-0000:01:00.0-render" rdev=E2:80 acl=rw exe="/usr/bin/libvirtd" ... res=success
Sep 05 23:53:23 fedora libvirtd[18306]: libvirt version: 12.0.0, package: 3.fc44 (Fedora Project, 2026-01-26-10:19:53, )
Sep 05 23:53:23 fedora libvirtd[18306]: hostname: fedora
Sep 05 23:53:23 fedora libvirtd[18306]: Unable to read from monitor: Connection reset by peer
Sep 05 23:53:23 fedora systemd[1]: machine-qemu\x2d1\x2dfedora\x2dapplication\x2dtest.scope: Deactivated successfully.
Sep 05 23:53:23 fedora libvirtd[18306]: internal error: QEMU unexpectedly closed the monitor (vm='fedora-application-test'):
2026-09-06T02:53:23.459506Z qemu-system-x86_64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
2026-09-06T02:53:23.459599Z qemu-system-x86_64: egl: render node init failed
Sep 05 23:53:23 fedora libvirtd[18306]: internal error: process exited while connecting to monitor:
2026-09-06T02:53:23.459506Z qemu-system-x86_64: egl: eglInitialize failed: EGL_NOT_INITIALIZED
2026-09-06T02:53:23.459599Z qemu-system-x86_64: egl: render node init failed
Sep 05 23:53:23 fedora systemd-machined[920]: Machine qemu-1-fedora-application-test terminated.
Sep 05 23:53:23 fedora audit[18306]: AUDIT2500 ... op=start reason=booted vm="fedora-application-test" ... res=failed
Virt-Manager XML:
Spice Server
<graphics type="spice">
<listen type="none"/>
<image compression="off"/>
<gl enable="yes" rendernode="/dev/dri/by-path/pci-0000:01:00.0-render"/>
</graphics>
Video Virtio
<video>
<model type="virtio" heads="1" primary="yes">
<acceleration accel3d="yes"/>
</model>
<address type="pci" domain="0x0000" bus="0x00" slot="0x01" function="0x0"/>
</video>
Overview
$ sudo virsh -c qemu:///system dumpxml fedora-application-test | grep -A 5 -E "graphics|video|model"
<controller type='usb' index='0' model='qemu-xhci' ports='15'>
<address type='pci' domain='0x0000' bus='0x02' slot='0x00' function='0x0'/>
</controller>
<controller type='pci' index='0' model='pcie-root'/>
<controller type='pci' index='1' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='1' port='0x10'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='2' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='2' port='0x11'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x1'/>
</controller>
<controller type='pci' index='3' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='3' port='0x12'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x2'/>
</controller>
<controller type='pci' index='4' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='4' port='0x13'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x3'/>
</controller>
<controller type='pci' index='5' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='5' port='0x14'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x4'/>
</controller>
<controller type='pci' index='6' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='6' port='0x15'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x5'/>
</controller>
<controller type='pci' index='7' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='7' port='0x16'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x6'/>
</controller>
<controller type='pci' index='8' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='8' port='0x17'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x02' function='0x7'/>
</controller>
<controller type='pci' index='9' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='9' port='0x18'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x0' multifunction='on'/>
</controller>
<controller type='pci' index='10' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='10' port='0x19'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x1'/>
</controller>
<controller type='pci' index='11' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='11' port='0x1a'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x2'/>
</controller>
<controller type='pci' index='12' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='12' port='0x1b'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x3'/>
</controller>
<controller type='pci' index='13' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='13' port='0x1c'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x4'/>
</controller>
<controller type='pci' index='14' model='pcie-root-port'>
<model name='pcie-root-port'/>
<target chassis='14' port='0x1d'/>
<address type='pci' domain='0x0000' bus='0x00' slot='0x03' function='0x5'/>
</controller>
<controller type='sata' index='0'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1f' function='0x2'/>
--
<model type='virtio'/>
<address type='pci' domain='0x0000' bus='0x01' slot='0x00' function='0x0'/>
</interface>
<serial type='pty'>
<target type='isa-serial' port='0'>
<model name='isa-serial'/>
</target>
</serial>
<console type='pty'>
<target type='serial' port='0'/>
</console>
--
<graphics type='spice'>
<listen type='none'/>
<image compression='off'/>
<gl enable='no'/>
</graphics>
<sound model='ich9'>
<address type='pci' domain='0x0000' bus='0x00' slot='0x1b' function='0x0'/>
</sound>
<audio id='1' type='spice'/>
<video>
<model type='virtio' heads='1' primary='yes'>
<acceleration accel3d='no'/>
</model>
<address type='pci' domain='0x0000' bus='0x00' slot='0x01' function='0x0'/>
</video>
<watchdog model='itco' action='reset'/>
<memballoon model='virtio'>
<address type='pci' domain='0x0000' bus='0x05' slot='0x00' function='0x0'/>
</memballoon>
<rng model='virtio'>
<backend model='random'>/dev/urandom</backend>
<address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</rng>
</devices>
</domain>
Virtualization:
$ lscpu | grep -i virtualization
Virtualization: AMD-V
$ virt-host-validate qemu
QEMU: Checking for hardware virtualization : PASS (SVM)
QEMU: Checking if device '/dev/kvm' exists : PASS
QEMU: Checking if device '/dev/kvm' is accessible : PASS
QEMU: Checking if device '/dev/vhost-net' exists : PASS
QEMU: Checking if device '/dev/net/tun' exists : PASS
QEMU: Checking for cgroup 'cpu' controller support : PASS
QEMU: Checking for cgroup 'cpuacct' controller support : PASS
QEMU: Checking for cgroup 'cpuset' controller support : PASS
QEMU: Checking for cgroup 'memory' controller support : PASS
QEMU: Checking for cgroup 'devices' controller support : WARN (Enable 'devices' in kernel Kconfig file or mount/enable cgroup controller in your system)
QEMU: Checking for cgroup 'blkio' controller support : PASS
QEMU: Checking for device assignment IOMMU support : PASS (IVRS)
QEMU: Checking if IOMMU is enabled by kernel : PASS
QEMU: Checking for secure guest support : WARN (None of SEV, SEV-ES, SEV-SNP, TDX available)
System Info:
OS: Fedora 44
DE: KDE Plasma 6.7.4 (wayland)
Kernel: 7.1.13-200.fc44.x86_64
CPU: Ryzen 5 7600
GPU: RTX 3060
NVIDIA driver: 610.57.04 (rpmfusion)
Virtualization: AMD-V
Hypervisor: KVM, QEMU:///SYSTEM