Re: [libvirt] [PATCH 4/4] qemu: add VFIO devices to cgroup ACL

2013-04-26 Thread Daniel P. Berrange
On Thu, Apr 25, 2013 at 09:44:33PM -0400, Laine Stump wrote: We don't know exactly the names of the VFIO devices that will be needed (and due to hotplug, we can't ever assume we won't need them at all), so we just add an ACL to allow any vfio device - they all have the major number 244

Re: [libvirt] [PATCH 4/4] qemu: add VFIO devices to cgroup ACL

2013-04-26 Thread Laine Stump
On 04/26/2013 04:52 AM, Daniel P. Berrange wrote: On Thu, Apr 25, 2013 at 09:44:33PM -0400, Laine Stump wrote: We don't know exactly the names of the VFIO devices that will be needed (and due to hotplug, we can't ever assume we won't need them at all), so we just add an ACL to allow any vfio

Re: [libvirt] [PATCH 4/4] qemu: add VFIO devices to cgroup ACL

2013-04-26 Thread Daniel P. Berrange
On Fri, Apr 26, 2013 at 11:16:14AM -0400, Laine Stump wrote: On 04/26/2013 04:52 AM, Daniel P. Berrange wrote: On Thu, Apr 25, 2013 at 09:44:33PM -0400, Laine Stump wrote: We don't know exactly the names of the VFIO devices that will be needed (and due to hotplug, we can't ever assume we

Re: [libvirt] [PATCH 4/4] qemu: add VFIO devices to cgroup ACL

2013-04-26 Thread Laine Stump
On 04/26/2013 11:42 AM, Daniel P. Berrange wrote: On Fri, Apr 26, 2013 at 11:16:14AM -0400, Laine Stump wrote: On 04/26/2013 04:52 AM, Daniel P. Berrange wrote: On Thu, Apr 25, 2013 at 09:44:33PM -0400, Laine Stump wrote: We don't know exactly the names of the VFIO devices that will be needed

Re: [libvirt] [PATCH 4/4] qemu: add VFIO devices to cgroup ACL

2013-04-26 Thread Eric Blake
On 04/26/2013 09:55 AM, Laine Stump wrote: We manage perfectly well to configure ACLs for individual disks that a VM is given without having to wildcard allow every single /dev/sdN disk. That fact that you were able to make the security drivers label the /dev/vfio/n devices correctly, shows