[PATCH 25/51] qemuxml2argvtest: Enable 'seccomp' sandbox in all fake caps tests

[Peter Krempa <pkrempa@xxxxxxxxxx>]

In order to minimize further churn, make all fake-caps test assume that
the seccomp sandbox is supported.

Signed-off-by: Peter Krempa <pkrempa@xxxxxxxxxx>
---
 tests/qemuxml2argvdata/acpi-table.args                          | 1 +
 tests/qemuxml2argvdata/autoindex.args                           | 1 +
 tests/qemuxml2argvdata/balloon-device-auto.args                 | 1 +
 tests/qemuxml2argvdata/balloon-device-deflate-off.args          | 1 +
 tests/qemuxml2argvdata/balloon-device-deflate.args              | 1 +
 tests/qemuxml2argvdata/balloon-device-period.args               | 1 +
 tests/qemuxml2argvdata/balloon-device.args                      | 1 +
 tests/qemuxml2argvdata/blkiotune-device.args                    | 1 +
 tests/qemuxml2argvdata/blkiotune.args                           | 1 +
 tests/qemuxml2argvdata/channel-guestfwd.args                    | 1 +
 tests/qemuxml2argvdata/channel-spicevmc.args                    | 1 +
 tests/qemuxml2argvdata/channel-virtio-auto.args                 | 1 +
 tests/qemuxml2argvdata/channel-virtio-autoadd.args              | 1 +
 tests/qemuxml2argvdata/channel-virtio-autoassign.args           | 1 +
 tests/qemuxml2argvdata/channel-virtio-default.args              | 1 +
 tests/qemuxml2argvdata/channel-virtio-state.args                | 1 +
 tests/qemuxml2argvdata/channel-virtio-unix.args                 | 1 +
 tests/qemuxml2argvdata/channel-virtio.args                      | 1 +
 tests/qemuxml2argvdata/chardev-reconnect.args                   | 1 +
 tests/qemuxml2argvdata/clock-catchup.args                       | 1 +
 tests/qemuxml2argvdata/clock-france.args                        | 1 +
 tests/qemuxml2argvdata/clock-hpet-off.args                      | 1 +
 tests/qemuxml2argvdata/clock-localtime-basis-localtime.args     | 1 +
 tests/qemuxml2argvdata/clock-localtime.args                     | 1 +
 tests/qemuxml2argvdata/clock-timer-hyperv-rtc.args              | 1 +
 tests/qemuxml2argvdata/clock-utc.args                           | 1 +
 tests/qemuxml2argvdata/clock-variable.args                      | 1 +
 tests/qemuxml2argvdata/console-virtio-many.args                 | 1 +
 tests/qemuxml2argvdata/console-virtio.args                      | 1 +
 tests/qemuxml2argvdata/controller-order.args                    | 1 +
 tests/qemuxml2argvdata/cpu-Haswell-noTSX.args                   | 1 +
 tests/qemuxml2argvdata/cpu-Haswell.args                         | 1 +
 tests/qemuxml2argvdata/cpu-Haswell2.args                        | 1 +
 tests/qemuxml2argvdata/cpu-Haswell3.args                        | 1 +
 tests/qemuxml2argvdata/cpu-cache-disable.args                   | 1 +
 tests/qemuxml2argvdata/cpu-cache-disable3.args                  | 1 +
 tests/qemuxml2argvdata/cpu-cache-emulate-l3.args                | 1 +
 tests/qemuxml2argvdata/cpu-cache-passthrough.args               | 1 +
 tests/qemuxml2argvdata/cpu-check-default-none.args              | 1 +
 tests/qemuxml2argvdata/cpu-check-default-none2.args             | 1 +
 tests/qemuxml2argvdata/cpu-check-default-partial.args           | 1 +
 tests/qemuxml2argvdata/cpu-check-default-partial2.args          | 1 +
 tests/qemuxml2argvdata/cpu-check-none.args                      | 1 +
 tests/qemuxml2argvdata/cpu-exact1.args                          | 1 +
 tests/qemuxml2argvdata/cpu-exact2-nofallback.args               | 1 +
 tests/qemuxml2argvdata/cpu-exact2.args                          | 1 +
 tests/qemuxml2argvdata/cpu-fallback.args                        | 1 +
 tests/qemuxml2argvdata/cpu-host-kvmclock.args                   | 1 +
 tests/qemuxml2argvdata/cpu-host-model-cmt.args                  | 1 +
 tests/qemuxml2argvdata/cpu-host-model-vendor.args               | 1 +
 tests/qemuxml2argvdata/cpu-host-passthrough-features.args       | 1 +
 tests/qemuxml2argvdata/cpu-host-passthrough.args                | 1 +
 tests/qemuxml2argvdata/cpu-kvmclock.args                        | 1 +
 tests/qemuxml2argvdata/cpu-minimum1.args                        | 1 +
 tests/qemuxml2argvdata/cpu-minimum2.args                        | 1 +
 tests/qemuxml2argvdata/cpu-no-removed-features.args             | 1 +
 tests/qemuxml2argvdata/cpu-numa-disjoint.args                   | 1 +
 tests/qemuxml2argvdata/cpu-numa-memshared.args                  | 1 +
 tests/qemuxml2argvdata/cpu-numa-no-memory-element.args          | 1 +
 tests/qemuxml2argvdata/cpu-numa1.args                           | 1 +
 tests/qemuxml2argvdata/cpu-numa2.args                           | 1 +
 tests/qemuxml2argvdata/cpu-phys-bits-emulate.args               | 1 +
 tests/qemuxml2argvdata/cpu-phys-bits-emulate2.args              | 1 +
 tests/qemuxml2argvdata/cpu-phys-bits-passthrough.args           | 1 +
 tests/qemuxml2argvdata/cpu-strict1.args                         | 1 +
 tests/qemuxml2argvdata/cpu-topology1.args                       | 1 +
 tests/qemuxml2argvdata/cpu-topology2.args                       | 1 +
 tests/qemuxml2argvdata/cpu-topology3.args                       | 1 +
 tests/qemuxml2argvdata/cpu-tsc-frequency.args                   | 1 +
 tests/qemuxml2argvdata/default-kvm-host-arch.args               | 1 +
 tests/qemuxml2argvdata/default-qemu-host-arch.args              | 1 +
 tests/qemuxml2argvdata/graphics-sdl-fullscreen.args             | 1 +
 tests/qemuxml2argvdata/graphics-sdl.args                        | 1 +
 tests/qemuxml2argvdata/hostdev-mdev-precreated.args             | 1 +
 tests/qemuxml2argvdata/hostdev-pci-address-unassigned.args      | 1 +
 tests/qemuxml2argvdata/hostdev-pci-multifunction.args           | 1 +
 tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pci.args         | 1 +
 tests/qemuxml2argvdata/hostdev-vfio-multidomain.args            | 1 +
 tests/qemuxml2argvdata/hostdev-vfio.args                        | 1 +
 tests/qemuxml2argvdata/hotplug-base.args                        | 1 +
 tests/qemuxml2argvdata/input-usbmouse-addr.args                 | 1 +
 tests/qemuxml2argvdata/input-usbmouse.args                      | 1 +
 tests/qemuxml2argvdata/input-usbtablet.args                     | 1 +
 tests/qemuxml2argvdata/kvm-pit-delay.args                       | 1 +
 tests/qemuxml2argvdata/kvm-pit-discard.args                     | 1 +
 tests/qemuxml2argvdata/kvmclock.args                            | 1 +
 tests/qemuxml2argvdata/machine-aliases1.args                    | 1 +
 tests/qemuxml2argvdata/machine-aliases2.args                    | 1 +
 tests/qemuxml2argvdata/machine-core-off.args                    | 1 +
 tests/qemuxml2argvdata/machine-core-on.args                     | 1 +
 tests/qemuxml2argvdata/machine-vmport-opt.args                  | 1 +
 tests/qemuxml2argvdata/memory-hotplug-dimm.args                 | 1 +
 tests/qemuxml2argvdata/memory-hotplug.args                      | 1 +
 tests/qemuxml2argvdata/memtune-unlimited.args                   | 1 +
 tests/qemuxml2argvdata/memtune.args                             | 1 +
 tests/qemuxml2argvdata/minimal.args                             | 1 +
 tests/qemuxml2argvdata/misc-acpi.args                           | 1 +
 tests/qemuxml2argvdata/misc-disable-s3.args                     | 1 +
 tests/qemuxml2argvdata/misc-disable-suspends.args               | 1 +
 tests/qemuxml2argvdata/misc-enable-s4.args                      | 1 +
 tests/qemuxml2argvdata/misc-uuid.args                           | 1 +
 tests/qemuxml2argvdata/multifunction-pci-device.args            | 1 +
 tests/qemuxml2argvdata/nosharepages.args                        | 1 +
 tests/qemuxml2argvdata/numad-auto-memory-vcpu-cpuset.args       | 1 +
 .../numad-auto-memory-vcpu-no-cpuset-and-placement.args         | 1 +
 tests/qemuxml2argvdata/numad-auto-vcpu-static-numatune.args     | 1 +
 tests/qemuxml2argvdata/numad-static-memory-auto-vcpu.args       | 1 +
 tests/qemuxml2argvdata/numad.args                               | 1 +
 tests/qemuxml2argvdata/pci-autoadd-addr.args                    | 1 +
 tests/qemuxml2argvdata/pci-autoadd-idx.args                     | 1 +
 tests/qemuxml2argvdata/pci-autofill-addr.args                   | 1 +
 tests/qemuxml2argvdata/pci-bridge-many-disks.args               | 1 +
 tests/qemuxml2argvdata/pci-bridge.args                          | 1 +
 tests/qemuxml2argvdata/pci-expander-bus.args                    | 1 +
 tests/qemuxml2argvdata/pci-many.args                            | 1 +
 tests/qemuxml2argvdata/pci-rom-disabled.args                    | 1 +
 tests/qemuxml2argvdata/pci-rom.args                             | 1 +
 tests/qemuxml2argvdata/pcie-expander-bus.args                   | 1 +
 tests/qemuxml2argvdata/pcie-root-port-model-generic.args        | 1 +
 tests/qemuxml2argvdata/pcie-root-port-model-ioh3420.args        | 1 +
 tests/qemuxml2argvdata/pcie-root-port.args                      | 1 +
 tests/qemuxml2argvdata/pcie-root.args                           | 1 +
 tests/qemuxml2argvdata/pcie-switch-downstream-port.args         | 1 +
 tests/qemuxml2argvdata/pcie-switch-upstream-port.args           | 1 +
 tests/qemuxml2argvdata/pcihole64-q35.args                       | 1 +
 tests/qemuxml2argvdata/pcihole64.args                           | 1 +
 tests/qemuxml2argvdata/pmu-feature-off.args                     | 1 +
 tests/qemuxml2argvdata/pmu-feature.args                         | 1 +
 tests/qemuxml2argvdata/q35-pci-force-address.args               | 1 +
 tests/qemuxml2argvdata/q35-usb2-multi.args                      | 1 +
 tests/qemuxml2argvdata/q35-usb2-reorder.args                    | 1 +
 tests/qemuxml2argvdata/q35-usb2.args                            | 1 +
 tests/qemuxml2argvdata/q35.args                                 | 1 +
 tests/qemuxml2argvdata/qemu-ns-alt.args                         | 1 +
 tests/qemuxml2argvdata/qemu-ns-commandline-ns0.args             | 1 +
 tests/qemuxml2argvdata/qemu-ns-commandline-ns1.args             | 1 +
 tests/qemuxml2argvdata/qemu-ns-commandline.args                 | 1 +
 tests/qemuxml2argvdata/qemu-ns-domain-commandline-ns0.args      | 1 +
 tests/qemuxml2argvdata/qemu-ns-domain-commandline.args          | 1 +
 tests/qemuxml2argvdata/qemu-ns-domain-ns0.args                  | 1 +
 tests/qemuxml2argvdata/qemu-ns-no-env.args                      | 1 +
 tests/qemuxml2argvdata/reboot-timeout-disabled.args             | 1 +
 tests/qemuxml2argvdata/reboot-timeout-enabled.args              | 1 +
 tests/qemuxml2argvdata/seclabel-dac-none.args                   | 1 +
 tests/qemuxml2argvdata/seclabel-dynamic-baselabel.args          | 1 +
 tests/qemuxml2argvdata/seclabel-dynamic-labelskip.args          | 1 +
 tests/qemuxml2argvdata/seclabel-dynamic-override.args           | 1 +
 tests/qemuxml2argvdata/seclabel-dynamic-relabel.args            | 1 +
 tests/qemuxml2argvdata/seclabel-dynamic.args                    | 1 +
 tests/qemuxml2argvdata/seclabel-none.args                       | 1 +
 tests/qemuxml2argvdata/seclabel-static-labelskip.args           | 1 +
 tests/qemuxml2argvdata/seclabel-static-relabel.args             | 1 +
 tests/qemuxml2argvdata/seclabel-static.args                     | 1 +
 tests/qemuxml2argvdata/smartcard-controller.args                | 1 +
 .../qemuxml2argvdata/smartcard-host-certificates-database.args  | 1 +
 tests/qemuxml2argvdata/smartcard-host-certificates.args         | 1 +
 tests/qemuxml2argvdata/smartcard-host.args                      | 1 +
 tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args      | 1 +
 tests/qemuxml2argvdata/smartcard-passthrough-tcp.args           | 1 +
 tests/qemuxml2argvdata/smbios.args                              | 1 +
 tests/qemuxml2argvdata/smp-dies.args                            | 1 +
 tests/qemuxml2argvdata/smp.args                                 | 1 +
 tests/qemuxml2argvdata/usb-controller-default-q35.args          | 1 +
 tests/qemuxml2argvdata/usb-controller-explicit-q35.args         | 1 +
 tests/qemuxml2argvdata/usb-controller-qemu-xhci.args            | 1 +
 tests/qemuxml2argvdata/usb-controller-xhci.args                 | 1 +
 tests/qemuxml2argvdata/usb-controller.args                      | 1 +
 tests/qemuxml2argvdata/usb-hub-autoadd-deluxe.args              | 1 +
 tests/qemuxml2argvdata/usb-hub-autoadd.args                     | 1 +
 tests/qemuxml2argvdata/usb-hub.args                             | 1 +
 tests/qemuxml2argvdata/usb-ich9-autoassign.args                 | 1 +
 tests/qemuxml2argvdata/usb-ich9-companion.args                  | 1 +
 tests/qemuxml2argvdata/usb-ich9-ehci-addr.args                  | 1 +
 tests/qemuxml2argvdata/usb-long-port-path.args                  | 1 +
 tests/qemuxml2argvdata/usb-none.args                            | 1 +
 tests/qemuxml2argvdata/usb-piix3-controller.args                | 1 +
 tests/qemuxml2argvdata/usb-port-autoassign.args                 | 1 +
 tests/qemuxml2argvdata/usb-port-missing.args                    | 1 +
 tests/qemuxml2argvdata/usb-ports.args                           | 1 +
 tests/qemuxml2argvdata/usb-redir-boot.args                      | 1 +
 tests/qemuxml2argvdata/usb-redir-filter-version.args            | 1 +
 tests/qemuxml2argvdata/usb-redir-filter.args                    | 1 +
 tests/qemuxml2argvdata/usb-redir.args                           | 1 +
 tests/qemuxml2argvdata/usb-xhci-autoassign.args                 | 1 +
 tests/qemuxml2argvdata/usb1-usb2.args                           | 1 +
 tests/qemuxml2argvdata/virtio-input-passthrough.args            | 1 +
 tests/qemuxml2argvdata/virtio-input.args                        | 1 +
 tests/qemuxml2argvdata/virtio-rng-default.args                  | 1 +
 tests/qemuxml2argvdata/virtio-rng-egd.args                      | 1 +
 tests/qemuxml2argvdata/virtio-rng-multiple.args                 | 1 +
 tests/qemuxml2argvdata/virtio-rng-random.args                   | 1 +
 tests/qemuxml2argvdata/vmcoreinfo.args                          | 1 +
 tests/qemuxml2argvtest.c                                        | 2 ++
 193 files changed, 194 insertions(+)

diff --git a/tests/qemuxml2argvdata/acpi-table.args b/tests/qemuxml2argvdata/acpi-table.args
index 339220c962..216a207860 100644
--- a/tests/qemuxml2argvdata/acpi-table.args
+++ b/tests/qemuxml2argvdata/acpi-table.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -acpitable sig=SLIC,file=/var/lib/libvirt/acpi/slic.dat \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/autoindex.args b/tests/qemuxml2argvdata/autoindex.args
index 110a203de3..e0c7471f3a 100644
--- a/tests/qemuxml2argvdata/autoindex.args
+++ b/tests/qemuxml2argvdata/autoindex.args
@@ -61,4 +61,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/balloon-device-auto.args b/tests/qemuxml2argvdata/balloon-device-auto.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/balloon-device-auto.args
+++ b/tests/qemuxml2argvdata/balloon-device-auto.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/balloon-device-deflate-off.args b/tests/qemuxml2argvdata/balloon-device-deflate-off.args
index 6936fa8958..2e2dfe69af 100644
--- a/tests/qemuxml2argvdata/balloon-device-deflate-off.args
+++ b/tests/qemuxml2argvdata/balloon-device-deflate-off.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","deflate-on-oom":false,"bus":"pci.0","addr":"0x12"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/balloon-device-deflate.args b/tests/qemuxml2argvdata/balloon-device-deflate.args
index d51bd5438c..1aac88ba43 100644
--- a/tests/qemuxml2argvdata/balloon-device-deflate.args
+++ b/tests/qemuxml2argvdata/balloon-device-deflate.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","deflate-on-oom":true,"bus":"pci.0","addr":"0x12"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/balloon-device-period.args b/tests/qemuxml2argvdata/balloon-device-period.args
index 57e56fc2bf..a3587435cf 100644
--- a/tests/qemuxml2argvdata/balloon-device-period.args
+++ b/tests/qemuxml2argvdata/balloon-device-period.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x12"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/balloon-device.args b/tests/qemuxml2argvdata/balloon-device.args
index 57e56fc2bf..a3587435cf 100644
--- a/tests/qemuxml2argvdata/balloon-device.args
+++ b/tests/qemuxml2argvdata/balloon-device.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x12"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/blkiotune-device.args b/tests/qemuxml2argvdata/blkiotune-device.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/blkiotune-device.args
+++ b/tests/qemuxml2argvdata/blkiotune-device.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/blkiotune.args b/tests/qemuxml2argvdata/blkiotune.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/blkiotune.args
+++ b/tests/qemuxml2argvdata/blkiotune.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-guestfwd.args b/tests/qemuxml2argvdata/channel-guestfwd.args
index 043167931c..d1370ade86 100644
--- a/tests/qemuxml2argvdata/channel-guestfwd.args
+++ b/tests/qemuxml2argvdata/channel-guestfwd.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -netdev '{"type":"user","guestfwd":[{"str":"tcp:10.0.2.1:4600-chardev:charchannel0"}],"id":"channel0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-spicevmc.args b/tests/qemuxml2argvdata/channel-spicevmc.args
index 0f211c5723..fa6a95985e 100644
--- a/tests/qemuxml2argvdata/channel-spicevmc.args
+++ b/tests/qemuxml2argvdata/channel-spicevmc.args
@@ -36,4 +36,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -spice port=5903,tls-port=5904,addr=127.0.0.1,x509-dir=/etc/pki/libvirt-spice,tls-channel=main,seamless-migration=on \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio-auto.args b/tests/qemuxml2argvdata/channel-virtio-auto.args
index 424c191b5e..17eb241e0b 100644
--- a/tests/qemuxml2argvdata/channel-virtio-auto.args
+++ b/tests/qemuxml2argvdata/channel-virtio-auto.args
@@ -47,4 +47,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtserialport","bus":"virtio-serial2.0","nr":1,"chardev":"charchannel5","id":"channel5","name":"org.linux-kvm.port.lla"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio-autoadd.args b/tests/qemuxml2argvdata/channel-virtio-autoadd.args
index 07b7e2f202..0f48ad41bc 100644
--- a/tests/qemuxml2argvdata/channel-virtio-autoadd.args
+++ b/tests/qemuxml2argvdata/channel-virtio-autoadd.args
@@ -46,4 +46,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtserialport","bus":"virtio-serial1.0","nr":3,"chardev":"charchannel5","id":"channel5","name":"org.linux-kvm.port.lla"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio-autoassign.args b/tests/qemuxml2argvdata/channel-virtio-autoassign.args
index c8d5a91a59..20460f718b 100644
--- a/tests/qemuxml2argvdata/channel-virtio-autoassign.args
+++ b/tests/qemuxml2argvdata/channel-virtio-autoassign.args
@@ -46,4 +46,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtserialport","bus":"virtio-serial1.0","nr":3,"chardev":"charchannel5","id":"channel5","name":"org.linux-kvm.port.lla"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio-default.args b/tests/qemuxml2argvdata/channel-virtio-default.args
index db44038462..fe0a9a9635 100644
--- a/tests/qemuxml2argvdata/channel-virtio-default.args
+++ b/tests/qemuxml2argvdata/channel-virtio-default.args
@@ -39,4 +39,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -spice port=0,seamless-migration=on \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio-state.args b/tests/qemuxml2argvdata/channel-virtio-state.args
index 1b7a8af721..7cb3ee8e2d 100644
--- a/tests/qemuxml2argvdata/channel-virtio-state.args
+++ b/tests/qemuxml2argvdata/channel-virtio-state.args
@@ -39,4 +39,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtserialport","bus":"virtio-serial1.0","nr":5,"chardev":"charchannel2","id":"channel2","name":"org.linux-kvm.port.foo2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio-unix.args b/tests/qemuxml2argvdata/channel-virtio-unix.args
index bb2f3e1898..9e5631a42d 100644
--- a/tests/qemuxml2argvdata/channel-virtio-unix.args
+++ b/tests/qemuxml2argvdata/channel-virtio-unix.args
@@ -41,4 +41,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev socket,id=charchannel3,fd=1729,server=on,wait=off \
 -device '{"driver":"virtserialport","bus":"virtio-serial0.0","nr":4,"chardev":"charchannel3","id":"channel3","name":"fdsa"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/channel-virtio.args b/tests/qemuxml2argvdata/channel-virtio.args
index 766c08e28c..fe467db7d5 100644
--- a/tests/qemuxml2argvdata/channel-virtio.args
+++ b/tests/qemuxml2argvdata/channel-virtio.args
@@ -35,4 +35,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtserialport","bus":"virtio-serial1.0","nr":3,"chardev":"charchannel0","id":"channel0","name":"org.linux-kvm.port.foo"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/chardev-reconnect.args b/tests/qemuxml2argvdata/chardev-reconnect.args
index 27c2d37514..186fe49746 100644
--- a/tests/qemuxml2argvdata/chardev-reconnect.args
+++ b/tests/qemuxml2argvdata/chardev-reconnect.args
@@ -42,4 +42,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev socket,id=charrng0,host=localhost,port=2345,reconnect=5 \
 -object '{"qom-type":"rng-egd","id":"objrng0","chardev":"charrng0"}' \
 -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-catchup.args b/tests/qemuxml2argvdata/clock-catchup.args
index 0ee37cae47..2c5e597b63 100644
--- a/tests/qemuxml2argvdata/clock-catchup.args
+++ b/tests/qemuxml2argvdata/clock-catchup.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-france.args b/tests/qemuxml2argvdata/clock-france.args
index 1aac60b73e..d14a923aa2 100644
--- a/tests/qemuxml2argvdata/clock-france.args
+++ b/tests/qemuxml2argvdata/clock-france.args
@@ -33,4 +33,5 @@ TZ=Europe/Paris \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-hpet-off.args b/tests/qemuxml2argvdata/clock-hpet-off.args
index 1ade114f84..9b98d4d9ae 100644
--- a/tests/qemuxml2argvdata/clock-hpet-off.args
+++ b/tests/qemuxml2argvdata/clock-hpet-off.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-localtime-basis-localtime.args b/tests/qemuxml2argvdata/clock-localtime-basis-localtime.args
index 2d100be581..6798dfb4d6 100644
--- a/tests/qemuxml2argvdata/clock-localtime-basis-localtime.args
+++ b/tests/qemuxml2argvdata/clock-localtime-basis-localtime.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-localtime.args b/tests/qemuxml2argvdata/clock-localtime.args
index 2b127d8eb3..5878a79725 100644
--- a/tests/qemuxml2argvdata/clock-localtime.args
+++ b/tests/qemuxml2argvdata/clock-localtime.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-timer-hyperv-rtc.args b/tests/qemuxml2argvdata/clock-timer-hyperv-rtc.args
index 5a7b6df7eb..f40f1d5588 100644
--- a/tests/qemuxml2argvdata/clock-timer-hyperv-rtc.args
+++ b/tests/qemuxml2argvdata/clock-timer-hyperv-rtc.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-utc.args b/tests/qemuxml2argvdata/clock-utc.args
index 4ed1fe72a5..b3adaac533 100644
--- a/tests/qemuxml2argvdata/clock-utc.args
+++ b/tests/qemuxml2argvdata/clock-utc.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/clock-variable.args b/tests/qemuxml2argvdata/clock-variable.args
index 061697f057..fc9255beb8 100644
--- a/tests/qemuxml2argvdata/clock-variable.args
+++ b/tests/qemuxml2argvdata/clock-variable.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/console-virtio-many.args b/tests/qemuxml2argvdata/console-virtio-many.args
index 8196f3039b..df4adeaa50 100644
--- a/tests/qemuxml2argvdata/console-virtio-many.args
+++ b/tests/qemuxml2argvdata/console-virtio-many.args
@@ -41,4 +41,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtconsole","chardev":"charconsole3","id":"console3"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/console-virtio.args b/tests/qemuxml2argvdata/console-virtio.args
index 12d846bc3d..a81368bd48 100644
--- a/tests/qemuxml2argvdata/console-virtio.args
+++ b/tests/qemuxml2argvdata/console-virtio.args
@@ -35,4 +35,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtconsole","chardev":"charconsole0","id":"console0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/controller-order.args b/tests/qemuxml2argvdata/controller-order.args
index 8ea076ce51..8f676e58fe 100644
--- a/tests/qemuxml2argvdata/controller-order.args
+++ b/tests/qemuxml2argvdata/controller-order.args
@@ -51,4 +51,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-fdr/.config \
 -device '{"driver":"hda-duplex","id":"sound0-codec0","bus":"sound0.0","cad":0,"audiodev":"audio1"}' \
 -device '{"driver":"usb-host","hostbus":14,"hostaddr":6,"id":"hostdev0","bus":"usb.0","port":"2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-Haswell-noTSX.args b/tests/qemuxml2argvdata/cpu-Haswell-noTSX.args
index ee856da83c..32d8054f4e 100644
--- a/tests/qemuxml2argvdata/cpu-Haswell-noTSX.args
+++ b/tests/qemuxml2argvdata/cpu-Haswell-noTSX.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-Haswell.args b/tests/qemuxml2argvdata/cpu-Haswell.args
index 3a19cd7e7d..9c732ad4bb 100644
--- a/tests/qemuxml2argvdata/cpu-Haswell.args
+++ b/tests/qemuxml2argvdata/cpu-Haswell.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-Haswell2.args b/tests/qemuxml2argvdata/cpu-Haswell2.args
index 7989bb54f1..51e6cf99bf 100644
--- a/tests/qemuxml2argvdata/cpu-Haswell2.args
+++ b/tests/qemuxml2argvdata/cpu-Haswell2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-Haswell3.args b/tests/qemuxml2argvdata/cpu-Haswell3.args
index 9a198712ee..ede85300c3 100644
--- a/tests/qemuxml2argvdata/cpu-Haswell3.args
+++ b/tests/qemuxml2argvdata/cpu-Haswell3.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-cache-disable.args b/tests/qemuxml2argvdata/cpu-cache-disable.args
index 341e2c9aff..b920ad022f 100644
--- a/tests/qemuxml2argvdata/cpu-cache-disable.args
+++ b/tests/qemuxml2argvdata/cpu-cache-disable.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-cache-disable3.args b/tests/qemuxml2argvdata/cpu-cache-disable3.args
index 1ea6896a8e..557d9c5ac4 100644
--- a/tests/qemuxml2argvdata/cpu-cache-disable3.args
+++ b/tests/qemuxml2argvdata/cpu-cache-disable3.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-cache-emulate-l3.args b/tests/qemuxml2argvdata/cpu-cache-emulate-l3.args
index 603f0ea0a2..f7f9403885 100644
--- a/tests/qemuxml2argvdata/cpu-cache-emulate-l3.args
+++ b/tests/qemuxml2argvdata/cpu-cache-emulate-l3.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-cache-passthrough.args b/tests/qemuxml2argvdata/cpu-cache-passthrough.args
index 1c7325e32a..e3911bea27 100644
--- a/tests/qemuxml2argvdata/cpu-cache-passthrough.args
+++ b/tests/qemuxml2argvdata/cpu-cache-passthrough.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-check-default-none.args b/tests/qemuxml2argvdata/cpu-check-default-none.args
index 5b75657eea..67f11be4bf 100644
--- a/tests/qemuxml2argvdata/cpu-check-default-none.args
+++ b/tests/qemuxml2argvdata/cpu-check-default-none.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-check-default-none2.args b/tests/qemuxml2argvdata/cpu-check-default-none2.args
index 6348b15672..e01ac72a16 100644
--- a/tests/qemuxml2argvdata/cpu-check-default-none2.args
+++ b/tests/qemuxml2argvdata/cpu-check-default-none2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-check-default-partial.args b/tests/qemuxml2argvdata/cpu-check-default-partial.args
index 0416205d82..90712d2eb7 100644
--- a/tests/qemuxml2argvdata/cpu-check-default-partial.args
+++ b/tests/qemuxml2argvdata/cpu-check-default-partial.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-check-default-partial2.args b/tests/qemuxml2argvdata/cpu-check-default-partial2.args
index d43bc435e1..45c130849d 100644
--- a/tests/qemuxml2argvdata/cpu-check-default-partial2.args
+++ b/tests/qemuxml2argvdata/cpu-check-default-partial2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-check-none.args b/tests/qemuxml2argvdata/cpu-check-none.args
index d43bc435e1..45c130849d 100644
--- a/tests/qemuxml2argvdata/cpu-check-none.args
+++ b/tests/qemuxml2argvdata/cpu-check-none.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-exact1.args b/tests/qemuxml2argvdata/cpu-exact1.args
index 45e15c91ce..17e0ea1a1f 100644
--- a/tests/qemuxml2argvdata/cpu-exact1.args
+++ b/tests/qemuxml2argvdata/cpu-exact1.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-exact2-nofallback.args b/tests/qemuxml2argvdata/cpu-exact2-nofallback.args
index acae725f2e..3c2a166ecd 100644
--- a/tests/qemuxml2argvdata/cpu-exact2-nofallback.args
+++ b/tests/qemuxml2argvdata/cpu-exact2-nofallback.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-exact2.args b/tests/qemuxml2argvdata/cpu-exact2.args
index acae725f2e..3c2a166ecd 100644
--- a/tests/qemuxml2argvdata/cpu-exact2.args
+++ b/tests/qemuxml2argvdata/cpu-exact2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-fallback.args b/tests/qemuxml2argvdata/cpu-fallback.args
index d6e2611cde..76961da609 100644
--- a/tests/qemuxml2argvdata/cpu-fallback.args
+++ b/tests/qemuxml2argvdata/cpu-fallback.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-host-kvmclock.args b/tests/qemuxml2argvdata/cpu-host-kvmclock.args
index e8f4f4d5c5..9f3f3dc7a4 100644
--- a/tests/qemuxml2argvdata/cpu-host-kvmclock.args
+++ b/tests/qemuxml2argvdata/cpu-host-kvmclock.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-host-model-cmt.args b/tests/qemuxml2argvdata/cpu-host-model-cmt.args
index 634a06e34a..499d485600 100644
--- a/tests/qemuxml2argvdata/cpu-host-model-cmt.args
+++ b/tests/qemuxml2argvdata/cpu-host-model-cmt.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-host-model-vendor.args b/tests/qemuxml2argvdata/cpu-host-model-vendor.args
index d39564cb89..b3cf8c4aa9 100644
--- a/tests/qemuxml2argvdata/cpu-host-model-vendor.args
+++ b/tests/qemuxml2argvdata/cpu-host-model-vendor.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-host-passthrough-features.args b/tests/qemuxml2argvdata/cpu-host-passthrough-features.args
index 6cce7f9aee..4cd3c83700 100644
--- a/tests/qemuxml2argvdata/cpu-host-passthrough-features.args
+++ b/tests/qemuxml2argvdata/cpu-host-passthrough-features.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-host-passthrough.args b/tests/qemuxml2argvdata/cpu-host-passthrough.args
index 5b75657eea..67f11be4bf 100644
--- a/tests/qemuxml2argvdata/cpu-host-passthrough.args
+++ b/tests/qemuxml2argvdata/cpu-host-passthrough.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-kvmclock.args b/tests/qemuxml2argvdata/cpu-kvmclock.args
index b2c18d17ba..b25e51d580 100644
--- a/tests/qemuxml2argvdata/cpu-kvmclock.args
+++ b/tests/qemuxml2argvdata/cpu-kvmclock.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-minimum1.args b/tests/qemuxml2argvdata/cpu-minimum1.args
index 0416205d82..90712d2eb7 100644
--- a/tests/qemuxml2argvdata/cpu-minimum1.args
+++ b/tests/qemuxml2argvdata/cpu-minimum1.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-minimum2.args b/tests/qemuxml2argvdata/cpu-minimum2.args
index 99ffab88d7..41b0e1fd91 100644
--- a/tests/qemuxml2argvdata/cpu-minimum2.args
+++ b/tests/qemuxml2argvdata/cpu-minimum2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-no-removed-features.args b/tests/qemuxml2argvdata/cpu-no-removed-features.args
index d43bc435e1..45c130849d 100644
--- a/tests/qemuxml2argvdata/cpu-no-removed-features.args
+++ b/tests/qemuxml2argvdata/cpu-no-removed-features.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-numa-disjoint.args b/tests/qemuxml2argvdata/cpu-numa-disjoint.args
index cb8581257a..6f13b9de0f 100644
--- a/tests/qemuxml2argvdata/cpu-numa-disjoint.args
+++ b/tests/qemuxml2argvdata/cpu-numa-disjoint.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-numa-memshared.args b/tests/qemuxml2argvdata/cpu-numa-memshared.args
index 1e07b930fe..4132bee971 100644
--- a/tests/qemuxml2argvdata/cpu-numa-memshared.args
+++ b/tests/qemuxml2argvdata/cpu-numa-memshared.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-numa-no-memory-element.args b/tests/qemuxml2argvdata/cpu-numa-no-memory-element.args
index ca93709c64..b28ad67612 100644
--- a/tests/qemuxml2argvdata/cpu-numa-no-memory-element.args
+++ b/tests/qemuxml2argvdata/cpu-numa-no-memory-element.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-numa1.args b/tests/qemuxml2argvdata/cpu-numa1.args
index ca93709c64..b28ad67612 100644
--- a/tests/qemuxml2argvdata/cpu-numa1.args
+++ b/tests/qemuxml2argvdata/cpu-numa1.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-numa2.args b/tests/qemuxml2argvdata/cpu-numa2.args
index ca93709c64..b28ad67612 100644
--- a/tests/qemuxml2argvdata/cpu-numa2.args
+++ b/tests/qemuxml2argvdata/cpu-numa2.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-phys-bits-emulate.args b/tests/qemuxml2argvdata/cpu-phys-bits-emulate.args
index b85ccebfc0..96efce2507 100644
--- a/tests/qemuxml2argvdata/cpu-phys-bits-emulate.args
+++ b/tests/qemuxml2argvdata/cpu-phys-bits-emulate.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-phys-bits-emulate2.args b/tests/qemuxml2argvdata/cpu-phys-bits-emulate2.args
index 0b08d7e145..e8a3bf58f0 100644
--- a/tests/qemuxml2argvdata/cpu-phys-bits-emulate2.args
+++ b/tests/qemuxml2argvdata/cpu-phys-bits-emulate2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-phys-bits-passthrough.args b/tests/qemuxml2argvdata/cpu-phys-bits-passthrough.args
index b85ce46a20..a3b9ddea01 100644
--- a/tests/qemuxml2argvdata/cpu-phys-bits-passthrough.args
+++ b/tests/qemuxml2argvdata/cpu-phys-bits-passthrough.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-strict1.args b/tests/qemuxml2argvdata/cpu-strict1.args
index 65749b9611..ef44967621 100644
--- a/tests/qemuxml2argvdata/cpu-strict1.args
+++ b/tests/qemuxml2argvdata/cpu-strict1.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-topology1.args b/tests/qemuxml2argvdata/cpu-topology1.args
index ee3ea3cb75..83f1a45c9b 100644
--- a/tests/qemuxml2argvdata/cpu-topology1.args
+++ b/tests/qemuxml2argvdata/cpu-topology1.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-topology2.args b/tests/qemuxml2argvdata/cpu-topology2.args
index 64372f05d7..3ebc709634 100644
--- a/tests/qemuxml2argvdata/cpu-topology2.args
+++ b/tests/qemuxml2argvdata/cpu-topology2.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-topology3.args b/tests/qemuxml2argvdata/cpu-topology3.args
index ee3ea3cb75..83f1a45c9b 100644
--- a/tests/qemuxml2argvdata/cpu-topology3.args
+++ b/tests/qemuxml2argvdata/cpu-topology3.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/cpu-tsc-frequency.args b/tests/qemuxml2argvdata/cpu-tsc-frequency.args
index 33ec51af4b..08252d7a74 100644
--- a/tests/qemuxml2argvdata/cpu-tsc-frequency.args
+++ b/tests/qemuxml2argvdata/cpu-tsc-frequency.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/default-kvm-host-arch.args b/tests/qemuxml2argvdata/default-kvm-host-arch.args
index 1554f13ba0..fab4e53bb3 100644
--- a/tests/qemuxml2argvdata/default-kvm-host-arch.args
+++ b/tests/qemuxml2argvdata/default-kvm-host-arch.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-kvm/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/default-qemu-host-arch.args b/tests/qemuxml2argvdata/default-qemu-host-arch.args
index a88774dc86..900da74fa5 100644
--- a/tests/qemuxml2argvdata/default-qemu-host-arch.args
+++ b/tests/qemuxml2argvdata/default-qemu-host-arch.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-qemu-host/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/graphics-sdl-fullscreen.args b/tests/qemuxml2argvdata/graphics-sdl-fullscreen.args
index cdec35daf7..7f73f2e364 100644
--- a/tests/qemuxml2argvdata/graphics-sdl-fullscreen.args
+++ b/tests/qemuxml2argvdata/graphics-sdl-fullscreen.args
@@ -34,4 +34,5 @@ DISPLAY=:0.1 \
 -full-screen \
 -display sdl \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/graphics-sdl.args b/tests/qemuxml2argvdata/graphics-sdl.args
index 1ac0995a24..f771948f4a 100644
--- a/tests/qemuxml2argvdata/graphics-sdl.args
+++ b/tests/qemuxml2argvdata/graphics-sdl.args
@@ -33,4 +33,5 @@ DISPLAY=:0.1 \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -display sdl \
 -device '{"driver":"VGA","id":"video0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hostdev-mdev-precreated.args b/tests/qemuxml2argvdata/hostdev-mdev-precreated.args
index 97424f3c56..b4a0092493 100644
--- a/tests/qemuxml2argvdata/hostdev-mdev-precreated.args
+++ b/tests/qemuxml2argvdata/hostdev-mdev-precreated.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest2/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"vfio-pci","id":"hostdev0","sysfsdev":"/sys/bus/mdev/devices/53764d0e-85a0-42b4-af5c-2046b460b1dc","display":"off","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hostdev-pci-address-unassigned.args b/tests/qemuxml2argvdata/hostdev-pci-address-unassigned.args
index 879deef04b..30c52bf3a5 100644
--- a/tests/qemuxml2argvdata/hostdev-pci-address-unassigned.args
+++ b/tests/qemuxml2argvdata/hostdev-pci-address-unassigned.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-delete/.config \
 -device '{"driver":"vfio-pci","host":"0005:90:01.2","id":"hostdev2","bus":"pci.0","addr":"0x3"}' \
 -device '{"driver":"vfio-pci","host":"0005:90:01.3","id":"hostdev3","bus":"pci.0","addr":"0x4"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x5"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hostdev-pci-multifunction.args b/tests/qemuxml2argvdata/hostdev-pci-multifunction.args
index 823112a276..073db68293 100644
--- a/tests/qemuxml2argvdata/hostdev-pci-multifunction.args
+++ b/tests/qemuxml2argvdata/hostdev-pci-multifunction.args
@@ -36,4 +36,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-delete/.config \
 -device '{"driver":"vfio-pci","host":"0000:06:12.1","id":"hostdev5","bus":"pci.0","addr":"0x7"}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.2","id":"hostdev6","bus":"pci.0","addr":"0x8"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x9"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pci.args b/tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pci.args
index 62e24de6e0..f8d4c6db21 100644
--- a/tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pci.args
+++ b/tests/qemuxml2argvdata/hostdev-scsi-vhost-scsi-pci.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest2/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"vhost-scsi-pci","wwpn":"naa.5123456789abcde0","vhostfd":"3","id":"hostdev0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hostdev-vfio-multidomain.args b/tests/qemuxml2argvdata/hostdev-vfio-multidomain.args
index 09b213afda..643d54f7cf 100644
--- a/tests/qemuxml2argvdata/hostdev-vfio-multidomain.args
+++ b/tests/qemuxml2argvdata/hostdev-vfio-multidomain.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest2/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"vfio-pci","host":"0021:de:1f.1","id":"hostdev0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hostdev-vfio.args b/tests/qemuxml2argvdata/hostdev-vfio.args
index 3d436c046d..e722f6e0ff 100644
--- a/tests/qemuxml2argvdata/hostdev-vfio.args
+++ b/tests/qemuxml2argvdata/hostdev-vfio.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest2/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.1","id":"hostdev0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/hotplug-base.args b/tests/qemuxml2argvdata/hotplug-base.args
index 3c2703d735..24f2e79228 100644
--- a/tests/qemuxml2argvdata/hotplug-base.args
+++ b/tests/qemuxml2argvdata/hotplug-base.args
@@ -30,4 +30,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-hotplug/.config \
 -device '{"driver":"virtio-serial-pci","id":"virtio-serial0","bus":"pci.0","addr":"0x4"}' \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/input-usbmouse-addr.args b/tests/qemuxml2argvdata/input-usbmouse-addr.args
index 6b1c787d4b..1c4e751547 100644
--- a/tests/qemuxml2argvdata/input-usbmouse-addr.args
+++ b/tests/qemuxml2argvdata/input-usbmouse-addr.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-mouse","id":"input0","bus":"usb.0","port":"2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/input-usbmouse.args b/tests/qemuxml2argvdata/input-usbmouse.args
index 77af8a128f..b6eab126b7 100644
--- a/tests/qemuxml2argvdata/input-usbmouse.args
+++ b/tests/qemuxml2argvdata/input-usbmouse.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -device '{"driver":"usb-mouse","id":"input0","bus":"usb.0","port":"1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/input-usbtablet.args b/tests/qemuxml2argvdata/input-usbtablet.args
index 9182426b07..34b982c024 100644
--- a/tests/qemuxml2argvdata/input-usbtablet.args
+++ b/tests/qemuxml2argvdata/input-usbtablet.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -device '{"driver":"usb-tablet","id":"input0","bus":"usb.0","port":"1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/kvm-pit-delay.args b/tests/qemuxml2argvdata/kvm-pit-delay.args
index 871a066e37..bc517cbb79 100644
--- a/tests/qemuxml2argvdata/kvm-pit-delay.args
+++ b/tests/qemuxml2argvdata/kvm-pit-delay.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/kvm-pit-discard.args b/tests/qemuxml2argvdata/kvm-pit-discard.args
index ffaed42bd9..c926618742 100644
--- a/tests/qemuxml2argvdata/kvm-pit-discard.args
+++ b/tests/qemuxml2argvdata/kvm-pit-discard.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/kvmclock.args b/tests/qemuxml2argvdata/kvmclock.args
index 84232c96b3..217527c731 100644
--- a/tests/qemuxml2argvdata/kvmclock.args
+++ b/tests/qemuxml2argvdata/kvmclock.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot strict=on \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/machine-aliases1.args b/tests/qemuxml2argvdata/machine-aliases1.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/machine-aliases1.args
+++ b/tests/qemuxml2argvdata/machine-aliases1.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/machine-aliases2.args b/tests/qemuxml2argvdata/machine-aliases2.args
index 2fdb43c621..f785eb07a3 100644
--- a/tests/qemuxml2argvdata/machine-aliases2.args
+++ b/tests/qemuxml2argvdata/machine-aliases2.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/machine-core-off.args b/tests/qemuxml2argvdata/machine-core-off.args
index 4ed1fe72a5..b3adaac533 100644
--- a/tests/qemuxml2argvdata/machine-core-off.args
+++ b/tests/qemuxml2argvdata/machine-core-off.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/machine-core-on.args b/tests/qemuxml2argvdata/machine-core-on.args
index 30a6ebf0b5..19caffadfb 100644
--- a/tests/qemuxml2argvdata/machine-core-on.args
+++ b/tests/qemuxml2argvdata/machine-core-on.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/machine-vmport-opt.args b/tests/qemuxml2argvdata/machine-vmport-opt.args
index 7e309f5d09..d77df81b08 100644
--- a/tests/qemuxml2argvdata/machine-vmport-opt.args
+++ b/tests/qemuxml2argvdata/machine-vmport-opt.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/memory-hotplug-dimm.args b/tests/qemuxml2argvdata/memory-hotplug-dimm.args
index 18c0316775..c163442363 100644
--- a/tests/qemuxml2argvdata/memory-hotplug-dimm.args
+++ b/tests/qemuxml2argvdata/memory-hotplug-dimm.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/memory-hotplug.args b/tests/qemuxml2argvdata/memory-hotplug.args
index 1e38bb58c2..78d5307ee6 100644
--- a/tests/qemuxml2argvdata/memory-hotplug.args
+++ b/tests/qemuxml2argvdata/memory-hotplug.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/memtune-unlimited.args b/tests/qemuxml2argvdata/memtune-unlimited.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/memtune-unlimited.args
+++ b/tests/qemuxml2argvdata/memtune-unlimited.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/memtune.args b/tests/qemuxml2argvdata/memtune.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/memtune.args
+++ b/tests/qemuxml2argvdata/memtune.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/minimal.args b/tests/qemuxml2argvdata/minimal.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/minimal.args
+++ b/tests/qemuxml2argvdata/minimal.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/misc-acpi.args b/tests/qemuxml2argvdata/misc-acpi.args
index 01bd000e48..ac30ed91a4 100644
--- a/tests/qemuxml2argvdata/misc-acpi.args
+++ b/tests/qemuxml2argvdata/misc-acpi.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/misc-disable-s3.args b/tests/qemuxml2argvdata/misc-disable-s3.args
index 6323b763ed..e229371a48 100644
--- a/tests/qemuxml2argvdata/misc-disable-s3.args
+++ b/tests/qemuxml2argvdata/misc-disable-s3.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/misc-disable-suspends.args b/tests/qemuxml2argvdata/misc-disable-suspends.args
index c91c97b023..515beb8dec 100644
--- a/tests/qemuxml2argvdata/misc-disable-suspends.args
+++ b/tests/qemuxml2argvdata/misc-disable-suspends.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/misc-enable-s4.args b/tests/qemuxml2argvdata/misc-enable-s4.args
index af5ece2df0..f8b2873c2d 100644
--- a/tests/qemuxml2argvdata/misc-enable-s4.args
+++ b/tests/qemuxml2argvdata/misc-enable-s4.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/misc-uuid.args b/tests/qemuxml2argvdata/misc-uuid.args
index 01bd000e48..ac30ed91a4 100644
--- a/tests/qemuxml2argvdata/misc-uuid.args
+++ b/tests/qemuxml2argvdata/misc-uuid.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/multifunction-pci-device.args b/tests/qemuxml2argvdata/multifunction-pci-device.args
index e12a9a7441..49dad593a3 100644
--- a/tests/qemuxml2argvdata/multifunction-pci-device.args
+++ b/tests/qemuxml2argvdata/multifunction-pci-device.args
@@ -41,4 +41,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"scsi-hd","bus":"scsi0.0","scsi-id":0,"device_id":"drive-scsi0-0-0","drive":"libvirt-1-format","id":"scsi0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/nosharepages.args b/tests/qemuxml2argvdata/nosharepages.args
index cde8d709d3..7bcc71d565 100644
--- a/tests/qemuxml2argvdata/nosharepages.args
+++ b/tests/qemuxml2argvdata/nosharepages.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/numad-auto-memory-vcpu-cpuset.args b/tests/qemuxml2argvdata/numad-auto-memory-vcpu-cpuset.args
index 955b0233f4..2e0c83d169 100644
--- a/tests/qemuxml2argvdata/numad-auto-memory-vcpu-cpuset.args
+++ b/tests/qemuxml2argvdata/numad-auto-memory-vcpu-cpuset.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/numad-auto-memory-vcpu-no-cpuset-and-placement.args b/tests/qemuxml2argvdata/numad-auto-memory-vcpu-no-cpuset-and-placement.args
index 955b0233f4..2e0c83d169 100644
--- a/tests/qemuxml2argvdata/numad-auto-memory-vcpu-no-cpuset-and-placement.args
+++ b/tests/qemuxml2argvdata/numad-auto-memory-vcpu-no-cpuset-and-placement.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/numad-auto-vcpu-static-numatune.args b/tests/qemuxml2argvdata/numad-auto-vcpu-static-numatune.args
index 755c6d7ba1..9f71a0150c 100644
--- a/tests/qemuxml2argvdata/numad-auto-vcpu-static-numatune.args
+++ b/tests/qemuxml2argvdata/numad-auto-vcpu-static-numatune.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/numad-static-memory-auto-vcpu.args b/tests/qemuxml2argvdata/numad-static-memory-auto-vcpu.args
index 955b0233f4..2e0c83d169 100644
--- a/tests/qemuxml2argvdata/numad-static-memory-auto-vcpu.args
+++ b/tests/qemuxml2argvdata/numad-static-memory-auto-vcpu.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/numad.args b/tests/qemuxml2argvdata/numad.args
index 955b0233f4..2e0c83d169 100644
--- a/tests/qemuxml2argvdata/numad.args
+++ b/tests/qemuxml2argvdata/numad.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-autoadd-addr.args b/tests/qemuxml2argvdata/pci-autoadd-addr.args
index 7772f468f2..5f7f1b458e 100644
--- a/tests/qemuxml2argvdata/pci-autoadd-addr.args
+++ b/tests/qemuxml2argvdata/pci-autoadd-addr.args
@@ -40,4 +40,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-fdr-br/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.7","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-autoadd-idx.args b/tests/qemuxml2argvdata/pci-autoadd-idx.args
index e8ea698e9c..eacf56c25b 100644
--- a/tests/qemuxml2argvdata/pci-autoadd-idx.args
+++ b/tests/qemuxml2argvdata/pci-autoadd-idx.args
@@ -41,4 +41,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-fdr-br/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.4","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-autofill-addr.args b/tests/qemuxml2argvdata/pci-autofill-addr.args
index 6f226370ec..bf07b1174a 100644
--- a/tests/qemuxml2argvdata/pci-autofill-addr.args
+++ b/tests/qemuxml2argvdata/pci-autofill-addr.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-fdr-br/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x4"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-bridge-many-disks.args b/tests/qemuxml2argvdata/pci-bridge-many-disks.args
index c84f98e9e8..d3e90b5309 100644
--- a/tests/qemuxml2argvdata/pci-bridge-many-disks.args
+++ b/tests/qemuxml2argvdata/pci-bridge-many-disks.args
@@ -346,4 +346,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-lots-of-disks/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"virtio-blk-pci","bus":"pci.3","addr":"0x10","drive":"libvirt-1-format","id":"virtio-disk679"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-bridge.args b/tests/qemuxml2argvdata/pci-bridge.args
index db93c647aa..aafb60b7c0 100644
--- a/tests/qemuxml2argvdata/pci-bridge.args
+++ b/tests/qemuxml2argvdata/pci-bridge.args
@@ -100,4 +100,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-fdr-br/.config \
 -k en-us \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-expander-bus.args b/tests/qemuxml2argvdata/pci-expander-bus.args
index 85634f4377..8bf472d386 100644
--- a/tests/qemuxml2argvdata/pci-expander-bus.args
+++ b/tests/qemuxml2argvdata/pci-expander-bus.args
@@ -97,4 +97,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-expander-test/.config \
 -device '{"driver":"e1000","netdev":"hostnet31","id":"net31","mac":"52:54:00:7e:6e:c8","bus":"pci.1","addr":"0x4"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-many.args b/tests/qemuxml2argvdata/pci-many.args
index 0f69ce9f5a..d64aa49985 100644
--- a/tests/qemuxml2argvdata/pci-many.args
+++ b/tests/qemuxml2argvdata/pci-many.args
@@ -117,4 +117,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-fdr-br/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-rom-disabled.args b/tests/qemuxml2argvdata/pci-rom-disabled.args
index ea34132861..dbc18d1f38 100644
--- a/tests/qemuxml2argvdata/pci-rom-disabled.args
+++ b/tests/qemuxml2argvdata/pci-rom-disabled.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -netdev '{"type":"user","id":"hostnet0"}' \
 -device '{"driver":"virtio-net-pci","netdev":"hostnet0","id":"net0","mac":"52:54:00:24:a5:9f","bus":"pci.0","addr":"0x2","romfile":""}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pci-rom.args b/tests/qemuxml2argvdata/pci-rom.args
index e3bf06a1ae..18e3290740 100644
--- a/tests/qemuxml2argvdata/pci-rom.args
+++ b/tests/qemuxml2argvdata/pci-rom.args
@@ -38,4 +38,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest2/.config \
 -device '{"driver":"vfio-pci","host":"0000:06:12.5","id":"hostdev0","bus":"pci.0","addr":"0x4","rombar":0}' \
 -device '{"driver":"vfio-pci","host":"0000:06:12.6","id":"hostdev1","bus":"pci.0","addr":"0x5","rombar":1,"romfile":"/etc/fake/bootrom.bin"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x6"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-expander-bus.args b/tests/qemuxml2argvdata/pcie-expander-bus.args
index acddaea4f5..64b7d5d7df 100644
--- a/tests/qemuxml2argvdata/pcie-expander-bus.args
+++ b/tests/qemuxml2argvdata/pcie-expander-bus.args
@@ -134,4 +134,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-pcie-expander-bus-te/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-root-port-model-generic.args b/tests/qemuxml2argvdata/pcie-root-port-model-generic.args
index 750b132e7a..86307c9bd8 100644
--- a/tests/qemuxml2argvdata/pcie-root-port-model-generic.args
+++ b/tests/qemuxml2argvdata/pcie-root-port-model-generic.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-root-port-model-ioh3420.args b/tests/qemuxml2argvdata/pcie-root-port-model-ioh3420.args
index 5e838ba2f4..271bfab93c 100644
--- a/tests/qemuxml2argvdata/pcie-root-port-model-ioh3420.args
+++ b/tests/qemuxml2argvdata/pcie-root-port-model-ioh3420.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-guest/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-root-port.args b/tests/qemuxml2argvdata/pcie-root-port.args
index c15270294a..cee54df33c 100644
--- a/tests/qemuxml2argvdata/pcie-root-port.args
+++ b/tests/qemuxml2argvdata/pcie-root-port.args
@@ -35,4 +35,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-root.args b/tests/qemuxml2argvdata/pcie-root.args
index afc072da93..656cd80665 100644
--- a/tests/qemuxml2argvdata/pcie-root.args
+++ b/tests/qemuxml2argvdata/pcie-root.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-switch-downstream-port.args b/tests/qemuxml2argvdata/pcie-switch-downstream-port.args
index 77057d94d5..3a346a1697 100644
--- a/tests/qemuxml2argvdata/pcie-switch-downstream-port.args
+++ b/tests/qemuxml2argvdata/pcie-switch-downstream-port.args
@@ -43,4 +43,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcie-switch-upstream-port.args b/tests/qemuxml2argvdata/pcie-switch-upstream-port.args
index f9a4dcc051..c4670c674e 100644
--- a/tests/qemuxml2argvdata/pcie-switch-upstream-port.args
+++ b/tests/qemuxml2argvdata/pcie-switch-upstream-port.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcihole64-q35.args b/tests/qemuxml2argvdata/pcihole64-q35.args
index 18d584e895..624cfc9264 100644
--- a/tests/qemuxml2argvdata/pcihole64-q35.args
+++ b/tests/qemuxml2argvdata/pcihole64-q35.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pcihole64.args b/tests/qemuxml2argvdata/pcihole64.args
index c3821eed8f..127e76b680 100644
--- a/tests/qemuxml2argvdata/pcihole64.args
+++ b/tests/qemuxml2argvdata/pcihole64.args
@@ -30,4 +30,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-foo/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pmu-feature-off.args b/tests/qemuxml2argvdata/pmu-feature-off.args
index 869560c07f..b711a3b79f 100644
--- a/tests/qemuxml2argvdata/pmu-feature-off.args
+++ b/tests/qemuxml2argvdata/pmu-feature-off.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot strict=on \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/pmu-feature.args b/tests/qemuxml2argvdata/pmu-feature.args
index 01b75e94fd..e0fa5a290e 100644
--- a/tests/qemuxml2argvdata/pmu-feature.args
+++ b/tests/qemuxml2argvdata/pmu-feature.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot strict=on \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/q35-pci-force-address.args b/tests/qemuxml2argvdata/q35-pci-force-address.args
index d8f0d2e282..33171a4d87 100644
--- a/tests/qemuxml2argvdata/q35-pci-force-address.args
+++ b/tests/qemuxml2argvdata/q35-pci-force-address.args
@@ -36,4 +36,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"hda-duplex","id":"sound0-codec0","bus":"sound0.0","cad":0,"audiodev":"audio1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/q35-usb2-multi.args b/tests/qemuxml2argvdata/q35-usb2-multi.args
index 23cc5aa775..f5d39447dc 100644
--- a/tests/qemuxml2argvdata/q35-usb2-multi.args
+++ b/tests/qemuxml2argvdata/q35-usb2-multi.args
@@ -47,4 +47,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/q35-usb2-reorder.args b/tests/qemuxml2argvdata/q35-usb2-reorder.args
index e6c0c1e20e..6641391bae 100644
--- a/tests/qemuxml2argvdata/q35-usb2-reorder.args
+++ b/tests/qemuxml2argvdata/q35-usb2-reorder.args
@@ -47,4 +47,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/q35-usb2.args b/tests/qemuxml2argvdata/q35-usb2.args
index 51d50f7673..a5a6aa300b 100644
--- a/tests/qemuxml2argvdata/q35-usb2.args
+++ b/tests/qemuxml2argvdata/q35-usb2.args
@@ -39,4 +39,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/q35.args b/tests/qemuxml2argvdata/q35.args
index b778f874d6..bd37012eb0 100644
--- a/tests/qemuxml2argvdata/q35.args
+++ b/tests/qemuxml2argvdata/q35.args
@@ -39,4 +39,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -device '{"driver":"qxl-vga","id":"video0","max_outputs":1,"ram_size":67108864,"vram_size":33554432,"bus":"pcie.0","addr":"0x1"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-alt.args b/tests/qemuxml2argvdata/qemu-ns-alt.args
index b62ad8f47f..1eb331073c 100644
--- a/tests/qemuxml2argvdata/qemu-ns-alt.args
+++ b/tests/qemuxml2argvdata/qemu-ns-alt.args
@@ -35,4 +35,5 @@ BAR='' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 -unknown parameter \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-commandline-ns0.args b/tests/qemuxml2argvdata/qemu-ns-commandline-ns0.args
index f3ca25ee90..9edde492ae 100644
--- a/tests/qemuxml2argvdata/qemu-ns-commandline-ns0.args
+++ b/tests/qemuxml2argvdata/qemu-ns-commandline-ns0.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' ARGUMENT \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-commandline-ns1.args b/tests/qemuxml2argvdata/qemu-ns-commandline-ns1.args
index f3ca25ee90..9edde492ae 100644
--- a/tests/qemuxml2argvdata/qemu-ns-commandline-ns1.args
+++ b/tests/qemuxml2argvdata/qemu-ns-commandline-ns1.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' ARGUMENT \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-commandline.args b/tests/qemuxml2argvdata/qemu-ns-commandline.args
index f3ca25ee90..9edde492ae 100644
--- a/tests/qemuxml2argvdata/qemu-ns-commandline.args
+++ b/tests/qemuxml2argvdata/qemu-ns-commandline.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' ARGUMENT \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-domain-commandline-ns0.args b/tests/qemuxml2argvdata/qemu-ns-domain-commandline-ns0.args
index f3ca25ee90..9edde492ae 100644
--- a/tests/qemuxml2argvdata/qemu-ns-domain-commandline-ns0.args
+++ b/tests/qemuxml2argvdata/qemu-ns-domain-commandline-ns0.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' ARGUMENT \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-domain-commandline.args b/tests/qemuxml2argvdata/qemu-ns-domain-commandline.args
index f3ca25ee90..9edde492ae 100644
--- a/tests/qemuxml2argvdata/qemu-ns-domain-commandline.args
+++ b/tests/qemuxml2argvdata/qemu-ns-domain-commandline.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' ARGUMENT \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-domain-ns0.args b/tests/qemuxml2argvdata/qemu-ns-domain-ns0.args
index f3ca25ee90..9edde492ae 100644
--- a/tests/qemuxml2argvdata/qemu-ns-domain-ns0.args
+++ b/tests/qemuxml2argvdata/qemu-ns-domain-ns0.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' ARGUMENT \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/qemu-ns-no-env.args b/tests/qemuxml2argvdata/qemu-ns-no-env.args
index 2dc4c55ca3..f8733cb900 100644
--- a/tests/qemuxml2argvdata/qemu-ns-no-env.args
+++ b/tests/qemuxml2argvdata/qemu-ns-no-env.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -unknown parameter \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/reboot-timeout-disabled.args b/tests/qemuxml2argvdata/reboot-timeout-disabled.args
index 00eb1321eb..da669f6ee1 100644
--- a/tests/qemuxml2argvdata/reboot-timeout-disabled.args
+++ b/tests/qemuxml2argvdata/reboot-timeout-disabled.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot reboot-timeout=-1,strict=on \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/reboot-timeout-enabled.args b/tests/qemuxml2argvdata/reboot-timeout-enabled.args
index a7c63c3bd0..d26bde8fa3 100644
--- a/tests/qemuxml2argvdata/reboot-timeout-enabled.args
+++ b/tests/qemuxml2argvdata/reboot-timeout-enabled.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot reboot-timeout=128,strict=on \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-dac-none.args b/tests/qemuxml2argvdata/seclabel-dac-none.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-dac-none.args
+++ b/tests/qemuxml2argvdata/seclabel-dac-none.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-dynamic-baselabel.args b/tests/qemuxml2argvdata/seclabel-dynamic-baselabel.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-dynamic-baselabel.args
+++ b/tests/qemuxml2argvdata/seclabel-dynamic-baselabel.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-dynamic-labelskip.args b/tests/qemuxml2argvdata/seclabel-dynamic-labelskip.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-dynamic-labelskip.args
+++ b/tests/qemuxml2argvdata/seclabel-dynamic-labelskip.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-dynamic-override.args b/tests/qemuxml2argvdata/seclabel-dynamic-override.args
index 20820924bc..682aa14b67 100644
--- a/tests/qemuxml2argvdata/seclabel-dynamic-override.args
+++ b/tests/qemuxml2argvdata/seclabel-dynamic-override.args
@@ -35,4 +35,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":1,"drive":"libvirt-1-format","id":"ide0-0-1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-dynamic-relabel.args b/tests/qemuxml2argvdata/seclabel-dynamic-relabel.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-dynamic-relabel.args
+++ b/tests/qemuxml2argvdata/seclabel-dynamic-relabel.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-dynamic.args b/tests/qemuxml2argvdata/seclabel-dynamic.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-dynamic.args
+++ b/tests/qemuxml2argvdata/seclabel-dynamic.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-none.args b/tests/qemuxml2argvdata/seclabel-none.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-none.args
+++ b/tests/qemuxml2argvdata/seclabel-none.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-static-labelskip.args b/tests/qemuxml2argvdata/seclabel-static-labelskip.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-static-labelskip.args
+++ b/tests/qemuxml2argvdata/seclabel-static-labelskip.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-static-relabel.args b/tests/qemuxml2argvdata/seclabel-static-relabel.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-static-relabel.args
+++ b/tests/qemuxml2argvdata/seclabel-static-relabel.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/seclabel-static.args b/tests/qemuxml2argvdata/seclabel-static.args
index b8d7a87cf2..e6364a8e65 100644
--- a/tests/qemuxml2argvdata/seclabel-static.args
+++ b/tests/qemuxml2argvdata/seclabel-static.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smartcard-controller.args b/tests/qemuxml2argvdata/smartcard-controller.args
index a03929ba37..779d5a424c 100644
--- a/tests/qemuxml2argvdata/smartcard-controller.args
+++ b/tests/qemuxml2argvdata/smartcard-controller.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ccid-card-emulated","backend":"nss-emulated","id":"smartcard0","bus":"ccid0.0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smartcard-host-certificates-database.args b/tests/qemuxml2argvdata/smartcard-host-certificates-database.args
index 740c59caaf..eb7a13cdfe 100644
--- a/tests/qemuxml2argvdata/smartcard-host-certificates-database.args
+++ b/tests/qemuxml2argvdata/smartcard-host-certificates-database.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ccid-card-emulated","backend":"certificates","cert1":"cert1","cert2":"cert2","cert3":"cert3","db":"/tmp/foo","id":"smartcard0","bus":"ccid0.0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smartcard-host-certificates.args b/tests/qemuxml2argvdata/smartcard-host-certificates.args
index 7d04cff1a6..f3b6c50f76 100644
--- a/tests/qemuxml2argvdata/smartcard-host-certificates.args
+++ b/tests/qemuxml2argvdata/smartcard-host-certificates.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ccid-card-emulated","backend":"certificates","cert1":"cert1","cert2":"cert2","cert3":"cert3","db":"/etc/pki/nssdb","id":"smartcard0","bus":"ccid0.0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smartcard-host.args b/tests/qemuxml2argvdata/smartcard-host.args
index a03929ba37..779d5a424c 100644
--- a/tests/qemuxml2argvdata/smartcard-host.args
+++ b/tests/qemuxml2argvdata/smartcard-host.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ccid-card-emulated","backend":"nss-emulated","id":"smartcard0","bus":"ccid0.0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args b/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args
index 9ce691d6d7..016be5321e 100644
--- a/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args
+++ b/tests/qemuxml2argvdata/smartcard-passthrough-spicevmc.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -spice port=0,seamless-migration=on \
 -device '{"driver":"cirrus-vga","id":"video0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args b/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args
index 6bda6a08c7..4acd0204f1 100644
--- a/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args
+++ b/tests/qemuxml2argvdata/smartcard-passthrough-tcp.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ccid-card-passthru","chardev":"charsmartcard0","id":"smartcard0","bus":"ccid0.0"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smbios.args b/tests/qemuxml2argvdata/smbios.args
index 100725e572..8450149b25 100644
--- a/tests/qemuxml2argvdata/smbios.args
+++ b/tests/qemuxml2argvdata/smbios.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smp-dies.args b/tests/qemuxml2argvdata/smp-dies.args
index 7cc3538ddf..4601db602e 100644
--- a/tests/qemuxml2argvdata/smp-dies.args
+++ b/tests/qemuxml2argvdata/smp-dies.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/smp.args b/tests/qemuxml2argvdata/smp.args
index 8933b62a9f..fa91ee5721 100644
--- a/tests/qemuxml2argvdata/smp.args
+++ b/tests/qemuxml2argvdata/smp.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -blockdev '{"node-name":"libvirt-1-format","read-only":false,"driver":"raw","file":"libvirt-1-storage"}' \
 -device '{"driver":"ide-hd","bus":"ide.0","unit":0,"drive":"libvirt-1-format","id":"ide0-0-0","bootindex":1}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-controller-default-q35.args b/tests/qemuxml2argvdata/usb-controller-default-q35.args
index f4be0cbc26..23bdedef6c 100644
--- a/tests/qemuxml2argvdata/usb-controller-default-q35.args
+++ b/tests/qemuxml2argvdata/usb-controller-default-q35.args
@@ -30,4 +30,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-controller-explicit-q35.args b/tests/qemuxml2argvdata/usb-controller-explicit-q35.args
index 39e88ccaa5..5c6eed22d1 100644
--- a/tests/qemuxml2argvdata/usb-controller-explicit-q35.args
+++ b/tests/qemuxml2argvdata/usb-controller-explicit-q35.args
@@ -30,4 +30,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-q35-test/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -global ICH9-LPC.noreboot=off \
 -watchdog-action reset \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-controller-qemu-xhci.args b/tests/qemuxml2argvdata/usb-controller-qemu-xhci.args
index fe331a489c..852574e17f 100644
--- a/tests/qemuxml2argvdata/usb-controller-qemu-xhci.args
+++ b/tests/qemuxml2argvdata/usb-controller-qemu-xhci.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot strict=on \
 -device '{"driver":"qemu-xhci","p2":8,"p3":8,"id":"usb","bus":"pci.0","addr":"0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-controller-xhci.args b/tests/qemuxml2argvdata/usb-controller-xhci.args
index fd6fc0a10e..f3eac45c57 100644
--- a/tests/qemuxml2argvdata/usb-controller-xhci.args
+++ b/tests/qemuxml2argvdata/usb-controller-xhci.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot strict=on \
 -device '{"driver":"nec-usb-xhci","p2":8,"p3":8,"id":"usb","bus":"pci.0","addr":"0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-controller.args b/tests/qemuxml2argvdata/usb-controller.args
index 9c60eb502f..c8de26e4ee 100644
--- a/tests/qemuxml2argvdata/usb-controller.args
+++ b/tests/qemuxml2argvdata/usb-controller.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -usb \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-hub-autoadd-deluxe.args b/tests/qemuxml2argvdata/usb-hub-autoadd-deluxe.args
index d29e39bb77..b3d9be2409 100644
--- a/tests/qemuxml2argvdata/usb-hub-autoadd-deluxe.args
+++ b/tests/qemuxml2argvdata/usb-hub-autoadd-deluxe.args
@@ -48,4 +48,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-tablet","id":"input15","bus":"usb.0","port":"2.1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-hub-autoadd.args b/tests/qemuxml2argvdata/usb-hub-autoadd.args
index f0ffc1595d..d419faa726 100644
--- a/tests/qemuxml2argvdata/usb-hub-autoadd.args
+++ b/tests/qemuxml2argvdata/usb-hub-autoadd.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-tablet","id":"input3","bus":"usb.0","port":"1.3"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-hub.args b/tests/qemuxml2argvdata/usb-hub.args
index 4a0b2513a8..02ec29b63e 100644
--- a/tests/qemuxml2argvdata/usb-hub.args
+++ b/tests/qemuxml2argvdata/usb-hub.args
@@ -30,4 +30,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-hub","id":"hub0","bus":"usb.0","port":"1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-ich9-autoassign.args b/tests/qemuxml2argvdata/usb-ich9-autoassign.args
index c444e4c940..59d8430a40 100644
--- a/tests/qemuxml2argvdata/usb-ich9-autoassign.args
+++ b/tests/qemuxml2argvdata/usb-ich9-autoassign.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-mouse","id":"input2","bus":"usb.0","port":"5"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-ich9-companion.args b/tests/qemuxml2argvdata/usb-ich9-companion.args
index 828d938af8..b935a43647 100644
--- a/tests/qemuxml2argvdata/usb-ich9-companion.args
+++ b/tests/qemuxml2argvdata/usb-ich9-companion.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ich9-usb-uhci3","masterbus":"usb.0","firstport":4,"bus":"pci.0","addr":"0x4.0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-ich9-ehci-addr.args b/tests/qemuxml2argvdata/usb-ich9-ehci-addr.args
index 7f605a1d9c..68b512e94b 100644
--- a/tests/qemuxml2argvdata/usb-ich9-ehci-addr.args
+++ b/tests/qemuxml2argvdata/usb-ich9-ehci-addr.args
@@ -40,4 +40,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"ich9-usb-uhci2","masterbus":"usb2.0","firstport":2,"bus":"pci.0","addr":"0x4.0x1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x5"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-long-port-path.args b/tests/qemuxml2argvdata/usb-long-port-path.args
index 40184c3919..242a39f6cd 100644
--- a/tests/qemuxml2argvdata/usb-long-port-path.args
+++ b/tests/qemuxml2argvdata/usb-long-port-path.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-hub","id":"hub3","bus":"usb.0","port":"1.1.1.1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-none.args b/tests/qemuxml2argvdata/usb-none.args
index 721417ae35..ba1e6d550f 100644
--- a/tests/qemuxml2argvdata/usb-none.args
+++ b/tests/qemuxml2argvdata/usb-none.args
@@ -28,4 +28,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -boot strict=on \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-piix3-controller.args b/tests/qemuxml2argvdata/usb-piix3-controller.args
index 55c20b4d59..b2d71ccb60 100644
--- a/tests/qemuxml2argvdata/usb-piix3-controller.args
+++ b/tests/qemuxml2argvdata/usb-piix3-controller.args
@@ -29,4 +29,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"piix3-usb-uhci","id":"usb","bus":"pci.0","addr":"0x1.0x2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-port-autoassign.args b/tests/qemuxml2argvdata/usb-port-autoassign.args
index b92a30aea1..35bddfc442 100644
--- a/tests/qemuxml2argvdata/usb-port-autoassign.args
+++ b/tests/qemuxml2argvdata/usb-port-autoassign.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-mouse","id":"input2","bus":"usb.0","port":"1.3"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-port-missing.args b/tests/qemuxml2argvdata/usb-port-missing.args
index 3022160377..f849fa2062 100644
--- a/tests/qemuxml2argvdata/usb-port-missing.args
+++ b/tests/qemuxml2argvdata/usb-port-missing.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-mouse","id":"input0","bus":"usb.0","port":"1.1"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-ports.args b/tests/qemuxml2argvdata/usb-ports.args
index e2d3eb7be9..70b15ef466 100644
--- a/tests/qemuxml2argvdata/usb-ports.args
+++ b/tests/qemuxml2argvdata/usb-ports.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-mouse","id":"input2","bus":"usb.0","port":"1.2.2"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-redir-boot.args b/tests/qemuxml2argvdata/usb-redir-boot.args
index 04f18dffd5..edbd32dd09 100644
--- a/tests/qemuxml2argvdata/usb-redir-boot.args
+++ b/tests/qemuxml2argvdata/usb-redir-boot.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev spicevmc,id=charredir1,name=usbredir \
 -device '{"driver":"usb-redir","chardev":"charredir1","id":"redir1","bootindex":2,"bus":"usb.0","port":"4"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-redir-filter-version.args b/tests/qemuxml2argvdata/usb-redir-filter-version.args
index b79daf5023..b1ac8d3980 100644
--- a/tests/qemuxml2argvdata/usb-redir-filter-version.args
+++ b/tests/qemuxml2argvdata/usb-redir-filter-version.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev spicevmc,id=charredir1,name=usbredir \
 -device '{"driver":"usb-redir","chardev":"charredir1","id":"redir1","filter":"0x08:0x15E1:0x2007:0x0109:1|0x08:0x15E1:0x2007:0x0940:1|-1:-1:-1:-1:0","bus":"usb.0","port":"2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-redir-filter.args b/tests/qemuxml2argvdata/usb-redir-filter.args
index d231b28901..714a983c62 100644
--- a/tests/qemuxml2argvdata/usb-redir-filter.args
+++ b/tests/qemuxml2argvdata/usb-redir-filter.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev spicevmc,id=charredir1,name=usbredir \
 -device '{"driver":"usb-redir","chardev":"charredir1","id":"redir1","filter":"0x08:0x15E1:0x2007:0x0110:1|-1:-1:-1:-1:0","bus":"usb.0","port":"5"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-redir.args b/tests/qemuxml2argvdata/usb-redir.args
index c304c11194..3fa6875a39 100644
--- a/tests/qemuxml2argvdata/usb-redir.args
+++ b/tests/qemuxml2argvdata/usb-redir.args
@@ -37,4 +37,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev spicevmc,id=charredir1,name=usbredir \
 -device '{"driver":"usb-redir","chardev":"charredir1","id":"redir1","bus":"usb.0","port":"4"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb-xhci-autoassign.args b/tests/qemuxml2argvdata/usb-xhci-autoassign.args
index abc1b9c0d8..14e62871ca 100644
--- a/tests/qemuxml2argvdata/usb-xhci-autoassign.args
+++ b/tests/qemuxml2argvdata/usb-xhci-autoassign.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-mouse","id":"input1","bus":"usb.0","port":"4"}' \
 -device '{"driver":"usb-mouse","id":"input2","bus":"usb.0","port":"5"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/usb1-usb2.args b/tests/qemuxml2argvdata/usb1-usb2.args
index 9f6a5d67f5..cf84b7279e 100644
--- a/tests/qemuxml2argvdata/usb1-usb2.args
+++ b/tests/qemuxml2argvdata/usb1-usb2.args
@@ -41,4 +41,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"usb-host","hostbus":14,"hostaddr":6,"id":"hostdev0","bus":"usb2.0","port":"1"}' \
 -device '{"driver":"usb-host","hostbus":14,"hostaddr":7,"id":"hostdev1","bus":"usb2.0","port":"2"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/virtio-input-passthrough.args b/tests/qemuxml2argvdata/virtio-input-passthrough.args
index 42c1447fc6..495d14b4b7 100644
--- a/tests/qemuxml2argvdata/virtio-input-passthrough.args
+++ b/tests/qemuxml2argvdata/virtio-input-passthrough.args
@@ -30,4 +30,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtio-input-host-pci","id":"input0","evdev":"/dev/input/event1234","bus":"pci.0","addr":"0x3"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/virtio-input.args b/tests/qemuxml2argvdata/virtio-input.args
index d41b6ebb15..273c475905 100644
--- a/tests/qemuxml2argvdata/virtio-input.args
+++ b/tests/qemuxml2argvdata/virtio-input.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtio-tablet-pci","id":"input2","bus":"pci.0","addr":"0x4"}' \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/virtio-rng-default.args b/tests/qemuxml2argvdata/virtio-rng-default.args
index c9ef5e5c82..243716bcc1 100644
--- a/tests/qemuxml2argvdata/virtio-rng-default.args
+++ b/tests/qemuxml2argvdata/virtio-rng-default.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/random"}' \
 -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.0","addr":"0x7"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/virtio-rng-egd.args b/tests/qemuxml2argvdata/virtio-rng-egd.args
index e35a93caa5..fc6ecb1118 100644
--- a/tests/qemuxml2argvdata/virtio-rng-egd.args
+++ b/tests/qemuxml2argvdata/virtio-rng-egd.args
@@ -32,4 +32,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev socket,id=charrng0,host=1.2.3.4,port=1234 \
 -object '{"qom-type":"rng-egd","id":"objrng0","chardev":"charrng0"}' \
 -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/virtio-rng-multiple.args b/tests/qemuxml2argvdata/virtio-rng-multiple.args
index 89e39c777e..30a0ecd92c 100644
--- a/tests/qemuxml2argvdata/virtio-rng-multiple.args
+++ b/tests/qemuxml2argvdata/virtio-rng-multiple.args
@@ -34,4 +34,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -chardev socket,id=charrng1,host=1.2.3.4,port=1234 \
 -object '{"qom-type":"rng-egd","id":"objrng1","chardev":"charrng1"}' \
 -device '{"driver":"virtio-rng-pci","rng":"objrng1","id":"rng1","bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/virtio-rng-random.args b/tests/qemuxml2argvdata/virtio-rng-random.args
index 95b34b6810..7cacfedce5 100644
--- a/tests/qemuxml2argvdata/virtio-rng-random.args
+++ b/tests/qemuxml2argvdata/virtio-rng-random.args
@@ -31,4 +31,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 -object '{"qom-type":"rng-random","id":"objrng0","filename":"/dev/urandom"}' \
 -device '{"driver":"virtio-rng-pci","rng":"objrng0","id":"rng0","max-bytes":123,"period":1234,"bus":"pci.0","addr":"0x3"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvdata/vmcoreinfo.args b/tests/qemuxml2argvdata/vmcoreinfo.args
index 4a27a21a15..040feca15f 100644
--- a/tests/qemuxml2argvdata/vmcoreinfo.args
+++ b/tests/qemuxml2argvdata/vmcoreinfo.args
@@ -33,4 +33,5 @@ XDG_CONFIG_HOME=/var/lib/libvirt/qemu/domain--1-QEMUGuest1/.config \
 -audiodev '{"id":"audio1","driver":"none"}' \
 -device '{"driver":"virtio-balloon-pci","id":"balloon0","bus":"pci.0","addr":"0x2"}' \
 -device '{"driver":"vmcoreinfo"}' \
+-sandbox on,obsolete=deny,elevateprivileges=deny,spawn=deny,resourcecontrol=deny \
 -msg timestamp=on
diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c
index 04c7814dce..00cde55b5a 100644
--- a/tests/qemuxml2argvtest.c
+++ b/tests/qemuxml2argvtest.c
@@ -861,6 +861,7 @@ mymain(void)
                  QEMU_CAPS_DEVICE_JSON, \
                  QEMU_CAPS_OBJECT_JSON, \
                  QEMU_CAPS_NETDEV_JSON, \
+                 QEMU_CAPS_SECCOMP_SANDBOX, \
                  __VA_ARGS__, \
                  QEMU_CAPS_LAST, \
                  ARG_END)
@@ -870,6 +871,7 @@ mymain(void)
                  QEMU_CAPS_DEVICE_JSON, \
                  QEMU_CAPS_OBJECT_JSON, \
                  QEMU_CAPS_NETDEV_JSON, \
+                 QEMU_CAPS_SECCOMP_SANDBOX, \
                  QEMU_CAPS_LAST, \
                  ARG_END)

-- 
2.41.0