Comment 7 for bug 1990499

The file placement of these
  u-boot-qemu: /usr/lib/u-boot/qemu-riscv64_smode/uboot.elf
  opensbi: /usr/lib/riscv64-linux-gnu/opensbi/generic/fw_jump.elf
is not ideal.

Roms and helpers are usually meant to be in
  /usr/share/qemu/

There you'd find firmwares, roms and such binaries.

But /usr/lib is explicitly prohibited, quote:

"""
  /*
   * Don't allow access to special files or restricted paths such as /bin, /sbin,
   * /usr/bin, /usr/sbin and /etc. This is in an effort to prevent read/write
   * access to system files which could be used to elevate privileges. This is a
   * safety measure in case libvirtd is under a restrictive profile and is
   * subverted and trying to escape confinement.
   *
   * Note that we cannot exclude block devices because they are valid devices.
   * The TEMPLATE file can be adjusted to explicitly disallow these if needed.
   *
   * RETURN: -1 on error, 0 if ok, 1 if blocked
   */
  static int
  valid_path(const char *path, const bool readonly)
  {
      const char * const restricted[] = {
          "/bin/",
          "/etc/",
          "/lib",
          "/lost+found/",
          "/proc/",
          "/sbin/",
          "/selinux/",
          "/sys/",
          "/usr/bin/",
          "/usr/lib",
          "/usr/sbin/",
          "/usr/share/",
          "/usr/local/bin/",
          "/usr/local/etc/",
          "/usr/local/lib",
          "/usr/local/sbin/"
      };
      /* these paths are ok for readonly, but not read/write */
      const char * const restricted_rw[] = {
          "/boot/",
          "/vmlinuz",
          "/initrd",
          "/initrd.img",
          "/usr/share/edk2/",
          "/usr/share/OVMF/", /* for OVMF images */
          "/usr/share/ovmf/", /* for OVMF images */
          "/usr/share/AAVMF/", /* for AAVMF images */
          "/usr/share/qemu-efi/", /* for AAVMF images */
          "/usr/share/qemu-efi-aarch64/" /* for AAVMF images */
      };
      /* override the above with these */
      const char * const override[] = {
          "/sys/devices/pci", /* for hostdev pci devices */
          "/sys/kernel/config/target/vhost", /* for hostdev vhost_scsi devices */
          "/etc/libvirt-sandbox/services/" /* for virt-sandbox service config */
      };
"""

Due to that virt-aa-helper which usually is responsible to add paths mentioned in the guest config can not add them.

We can not change the on disc location, since they are out in the field.
Therefore I think for this particular case we want to add those path prefixes (matching the packaged location) to explicitly allow those, despite being under /usr/lib.
- /usr/lib/u-boot/
- /usr/lib/riscv64-linux-gnu/opensbi

I can create a patch for that and build PPAs with it.
If it works fine for us I can submit that to upstream and once accepted we'd drive those fixes into Jammy+Kinetic.