Should 'virt-rescue -a some.img --ro' tell qemu/kvm that some.img is supposed to be read-only in the guest? I have not looked at the code yet, perhaps --ro has a meaning only when attaching to a live guest. I was expecting that all write access to some.img is denied in the rescue shell. Olaf