graphic: 0.990
x86: 0.902
user-level: 0.895
performance: 0.875
device: 0.861
semantic: 0.836
PID: 0.790
peripherals: 0.781
architecture: 0.744
boot: 0.726
debug: 0.697
ppc: 0.658
permissions: 0.650
socket: 0.648
kernel: 0.596
network: 0.593
files: 0.558
vnc: 0.555
i386: 0.543
hypervisor: 0.511
register: 0.483
VMM: 0.462
mistranslation: 0.449
virtual: 0.446
TCG: 0.381
risc-v: 0.372
arm: 0.323
assembly: 0.235
KVM: 0.130

[CRASH] OpenGL acceleration except gtk: bad interaction between NVIDIA usermode opengl libraries and QEMU seccomp -sandbox on,spawn=deny, crashes immediately on startup with Bad system call
Description of problem:
When running any of the above command lines, QEMU crashes with Bad system call (core dumped). Not exclusive to spice; it seems this is caused by QEMU forking during OpenGL initialization after seccomp takes effect.
Steps to reproduce:
1. Run the above commandline
2. Notice a Bad system call (core dumped)
Additional information:
This crash only happens if spawn=deny is set, resourcecontrol/obsolete/elevateprivileges don't cause crashes.

The crash happens around the same time as an audit event is generated in dmesg: `audit: type=1326 audit(1705775880.776:14): auid=MYUSERID uid=MYUID gid=MYGID ses=REDACTED pid=REDACTED comm="qemu-system-x86" exe="/usr/bin/qemu-system-x86_64" sig=31 arch=c000003e syscall=56 compat=0 ip=REDACTED code=REDACTED`

`ausyscall c000003e 56` tells me it's `clone` which (iirc) is the syscall used by glibc to implement fork() (I might be wrong about glibc part)

Suggested solution: move seccomp activation until just before guest code starts executing? make frontends (ie -display gtk/sdl/whatever, including -spice) initialize before seccomp?

Workaround: `chmod -x /bin/nvidia-modprobe` if not using the NVIDIA gpu or use this wrapper script (untested, not enterprise-ready, I am not responsible if unexpected things happen):
- rename /bin/qemu-system-x86_64 to qemu-system-x86_64.real
- put this in /bin/qemu-system-x86_64 and chmod +x it
```sh
#!/usr/bin/env sh
chmod -x /bin/nvidia-modprobe
qemu-system-x86_64.real $@ & disown
sleep 10 # excessive but maybe safer?
chmod +x /bin/nvidia-modprobe
```
Also, you can use -display gtk,gl=on instead, or (unknown security implications) remove spawn=deny from -sandbox args

original bug report was https://gitlab.com/libvirt/libvirt/-/issues/585 but I realized this was more of a qemu issue than a libvirt one