From: alexander.wetzel@web.de (Alexander Wetzel)
Date: Tue, 09 Jun 2015 00:39:00 +0200
Subject: [refpolicy] [PATCH] proposal for libvirt vfio/vt-d support
In-Reply-To: <20150608213723.GB6341@x131e>
References: <55746E03.90502@web.de>
	<55747110.5030901@web.de>	<20150607172613.GB21587@x131e>
	<557604EB.4000404@web.de> <20150608213723.GB6341@x131e>
Message-ID: <55761984.6030009@web.de>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

>> Since it's working now without
>> "allow virtd_t vfio_device_t:chr_file setattr;"
>> I've also dropped that from the patch.
> 
> I wonder what that is all about. Back when i was using this functionality this only worked with root UID.
> I wonder if that is still the case. Maybe it now works with unprivilege UID and it may need to set attributes in that scenario.

I may mix it up after all the time since checking the documentation, but for my understanding vfio is the "new" device passthrough, 
which no longer needs root privileges. The virtual test instance is running with the user qemu and the /dev/vfio/2 device created 
for the passthrough is also owned by qemu:

# ls -lZ /dev/vfio/
total 0
crw-------. 1 qemu qemu system_u:object_r:svirt_image_t:s0:c412,c565 248,   0 Jun  8 15:44 2
crw-rw-rw-. 1 root root system_u:object_r:vfio_device_t:s0            10, 196 Jun  7 22:08 vfio

Nevertheless I do not need setattr any longer, sesearch is not finding any rule for that but it's still working.