Comment 59 for bug 787091

I can only think of one other explanation, the devices cgroup. Can you, while that VM is running, do

ps -ef

to get the PID of the kvm process, then do

cat /proc/$PID/cgroup

(substituting in the pid)?

Assuming it reads something like

1:blkio,net_cls,freezer,devices,memory,cpuacct,cpu,ns,cpuset:/libvirt/qemu/lxc-natty-amd64

you would then find the cgroups mountpoint using
   mount | grep cgroup
and print out the device whitelist using:

cat /cgroup/libvirt/qemu/lxc-natty-amd64

(substituting your cgroup mountpoint for '/cgroup').

If I'm not being clear enough here, please start by just giving me the output of:

   for p in `pidof kvm`; do
      cat /proc/$p/cgroup
   done
   mount | grep cgroup