On Tue, Aug 11, 2026 at 14:52:38 +0200, Hector Cao via Devel wrote: > Attaching a vfio-ccw mediated device as a <hostdev> fails under the > libvirt-qemu AppArmor profile because QEMU's channel subsystem code > (hw/s390x/css.c) reads several sysfs attributes of the passed-through > subchannel when building the guest SCHIB, and the profile does not grant > read access to them: > > css_sch_get_chpids() -> /sys/bus/css/devices/<id>/chpids > css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom > css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type > > The first two are opened via /sys/bus/css/devices/<id> symlinks, which > AppArmor resolves to the real device path /sys/devices/css<n>/<id>/ > before mediating the access; the CHPID type file is read directly under > /sys/devices/. Without these rules the attach (or hotplug) fails with an > AppArmor DENIED message and QEMU aborts with: > > s390_ccw_realize: Failed to build initial schib: Invalid argument > > Add narrowly-scoped read rules for these three files so vfio-ccw > passthrough works without granting broad access to /sys/devices/css*. > > Signed-off-by: Hector Cao <[email protected]> > --- > src/security/apparmor/libvirt-qemu | 10 ++++++++++ > 1 file changed, 10 insertions(+) > > diff --git a/src/security/apparmor/libvirt-qemu > b/src/security/apparmor/libvirt-qemu > index e4aceacd70..428f9a9731 100644 > --- a/src/security/apparmor/libvirt-qemu > +++ b/src/security/apparmor/libvirt-qemu > @@ -50,6 +50,16 @@ > /run/udev/data/c16[6,7]* r, > /run/udev/data/c18[0,8,9]* r, > > + # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads > + # the channel-path masks, CHPID list and CHPID type of the passed-through > + # subchannel from sysfs when building the guest SCHIB. The chpids and > + # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that > + # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read > + # directly from /sys/devices/cssN/chp0.<chpid>/. > + /sys/devices/css[0-9]*/*/chpids r, > + /sys/devices/css[0-9]*/*/pimpampom r, > + /sys/devices/css[0-9]*/chp0.*/type r, > + > # WARNING: this gives the guest direct access to host hardware and specific > # portions of shared memory. This is required for sound using ALSA with > kvm, > # but may constitute a security risk. If your environment does not require > -- > 2.43.0 >
While I personally don't care about s390x, since nobody objected and this adds just read access: Reviewed-by: Peter Krempa <[email protected]> and I'll push this shortly
