From: dac.override@gmail.com (Dominick Grift)
Date: Tue, 9 Jun 2015 15:52:47 +0200
Subject: [refpolicy] [PATCH] proposal for libvirt vfio/vt-d support
In-Reply-To: <55761984.6030009@web.de>
References: <55746E03.90502@web.de> <55747110.5030901@web.de>
	<20150607172613.GB21587@x131e> <557604EB.4000404@web.de>
	<20150608213723.GB6341@x131e> <55761984.6030009@web.de>
Message-ID: <20150609135246.GC6341@x131e>
To: refpolicy@oss.tresys.com
List-Id: refpolicy.oss.tresys.com

On Tue, Jun 09, 2015 at 12:39:00AM +0200, Alexander Wetzel wrote:
> >> Since it's working now without
> >> "allow virtd_t vfio_device_t:chr_file setattr;"
> >> I've also dropped that from the patch.
> > 
> > I wonder what that is all about. Back when i was using this functionality this only worked with root UID.
> > I wonder if that is still the case. Maybe it now works with unprivilege UID and it may need to set attributes in that scenario.
> 
> I may mix it up after all the time since checking the documentation, but for my understanding vfio is the "new" device passthrough, 
> which no longer needs root privileges. The virtual test instance is running with the user qemu and the /dev/vfio/2 device created 
> for the passthrough is also owned by qemu:

I see

> 
> # ls -lZ /dev/vfio/
> total 0
> crw-------. 1 qemu qemu system_u:object_r:svirt_image_t:s0:c412,c565 248,   0 Jun  8 15:44 2
> crw-rw-rw-. 1 root root system_u:object_r:vfio_device_t:s0            10, 196 Jun  7 22:08 vfio

Yes, so since svirt_image_t is a customizable type this should work fine.

> 
> Nevertheless I do not need setattr any longer, sesearch is not finding any rule for that but it's still working.

Fine with me. If it turns out it is required in some scenario we can alway's add it.

-- 
02DFF788
4D30 903A 1CF3 B756 FB48  1514 3148 83A2 02DF F788
http://keys.gnupg.net/pks/lookup?op=vindex&search=0x314883A202DFF788
Dominick Grift
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 648 bytes
Desc: not available
Url : http://oss.tresys.com/pipermail/refpolicy/attachments/20150609/7ca5112a/attachment-0001.bin