A few months ago, I was getting some permissions errors when trying to create new VMs with virt-install. My main symptom was that I would get this error:

Could not open '/var/lib/libvirt/qemu/nvram/openwisp_VARS.fd': Permission denied

I recently tracked it down to an AppArmor profile issue. Fixing it was simple. I appended the following to /etc/apparmor.d/abstractions/libvirt:

  /var/lib/libvirt/qemu/nvram/** rwk,  
  /usr/share/OVMF/** rk,

This will also fix some other errors, such as the ‘Failed to lock byte 100’ and ‘cannot load apparmor profile’ errors.