[libvirt] [PATCH 2/2] qemu_cgroup: allow access to /dev/dri/render*

[Daniel P. Berrange]

On Thu, Nov 10, 2016 at 10:35:46AM +0000, Marc-André Lureau wrote:
> Hi
> 
> What's the status with this patch? If I understand the discussion, it is
> needed, but not enough. Now that SELinux has been fixed (both in f24/f25
> now), I can see only the ACL left: setfacl -m u:qemu:rw /dev/dri/renderD128
> + this patch allows me to setup a system VM with virgl. (though tbh, I
> would be fine restricting virgl to qemu:///session only)

This ties in with the discussion we've just been having around udev
and DAC/MAC labelling of device nodes. With my proposed solution of
using a new mount namespace + dedicated /dev per VM, then granting
DAC access to the DRI nodes is easy.


Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://entangle-photo.org       -o-    http://search.cpan.org/~danberr/ :|