fix(core): add libvirt patch for USB startupPolicy in containers

Signed-off-by: Yaroslav Borbat <yaroslav.borbat@flant.com>

Author: yaroslavborbat

images/packages/libvirt/patches/005-usb-startup-policy-in-containers.patch

@@ -0,0 +1,29 @@
+diff --git a/src/util/virusb.c b/src/util/virusb.c
+index cf3461f80a..5a92098452 100644
+--- a/src/util/virusb.c
++++ b/src/util/virusb.c
+@@ -169,6 +169,24 @@ virUSBDeviceSearch(unsigned int vendor,
+         if (!usb)
+             goto cleanup;
+ 
++        /* In containerized environments sysfs may expose USB devices
++         * from the host kernel while the corresponding device node
++         * under /dev/bus/usb/ is not present in the container's mount
++         * namespace.  Skip such devices so that callers relying on
++         * startupPolicy='optional' see an empty result and can handle
++         * the missing device gracefully. */
++        if (virUSBDeviceGetPath(usb) &&
++            !virFileExists(virUSBDeviceGetPath(usb))) {
++            VIR_DEBUG("USB device %03u:%03u found in sysfs but "
++                      "device node '%s' is not accessible, skipping",
++                      found_bus, found_devno,
++                      virUSBDeviceGetPath(usb));
++            g_clear_pointer(&usb, virUSBDeviceFree);
++            if (found)
++                break;
++            continue;
++        }
++
+         if (virUSBDeviceListAdd(list, &usb) < 0)
+             goto cleanup;
+ 

images/packages/libvirt/patches/README.md

@@ -41,3 +41,11 @@ This feature enhances security by preventing unauthorized access to the socket a
 Fixes a non-shared storage migration cancel race in libvirt/QEMU.
 
 After `AbortJob`, mirror block jobs may become `concluded` in QEMU while libvirt still polls synchronous migration mirrors. The patch refreshes monitor job status and drives pending terminal transitions so concluded jobs are dismissed/unregistered and do not block subsequent migrations.
+
+## 005-usb-startup-policy-in-containers.patch
+
+Fixes `startupPolicy='optional'` for USB hostdev in containerized environments.
+
+In containers, sysfs (`/sys/bus/usb/devices/`) is mounted from the host kernel and exposes all USB devices regardless of mount namespace isolation. This causes `virUSBDeviceSearch` to report a device as available even when the corresponding `/dev/bus/usb/` node is not present in the container's mount namespace. As a result, `startupPolicy='optional'` does not remove the missing hostdev from the domain XML, and QEMU fails to start.
+
+The patch adds a `virFileExists` check on the device node path after sysfs discovery. If the node is missing, the device is skipped so that callers see an empty result and handle the absence gracefully.