proposal for libvirt vfio/vt-d support

The attached patch proposes a way to allow pci device pass through via a new selinux boolean "virt_use_vfio" for libvirt.

This was originally proposed in a slightly different version as gentoo enhancement here: https://bugs.gentoo.org/show_bug.cgi?id=522736
(It's only tested as patch against the gentoo version of the refpoliciy.)

I used it for around one year to pass an ISDN PCIe card to a guest and verified today the function with an USB PCI device. (The ISDN card is no longer in the system.)
USB HUP was ok in guest with lspci and lsusb, but a USB stick did not work as expected. That's not related to selinux and was ignored here, since I have the same problem with selinux in permissive mode on the host.

The patch adds "vfio_device_t;", the boolean virt_use_vfio and when the boolean is set the following rules:

allow virtd_t self:process setrlimit;
allow virtd_t self:capability sys_resource;
allow virtd_t svirt_t:process rlimitinh;
allow virtd_t vfio_device_t:chr_file { relabelfrom setattr }; allow svirt_t vfio_device_t:chr_file { read write open ioctl };

Here the errors I get when I remove one of the rights (keeping all the others in place):

Without "allow virtd_t self:process setrlimit" or "allow virtd_t self:capability sys_resource":
error: Failed to start domain web-old
error: internal error: Process exited prior to exec: libvirt: error :
cannot limit locked memory to 5368709120: Permission denied

Without "allow virtd_t svirt_t:process rlimitinh":
error: Failed to start domain web-old
error: internal error: early end of file from monitor: possible problem:

2015-06-07T14:28:21.433403Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x0, 0xa0000, 0x39030000000) = -12 (Cannot
allocate memory)
2015-06-07T14:28:21.433480Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0xc0000, 0x20000, 0x39144200000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433538Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x100000, 0xdff00000, 0x39030100000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433707Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x100000000, 0x20000000, 0x39110000000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433730Z qemu-system-x86_64: -device

vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1: vfio:

Without "allow virtd_t vfio_device_t:chr_file relabelfrom"
error: Failed to start domain web-old
error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c587,c898' on '/dev/vfio/2':
Permission denied

Without "allow virtd_t vfio_device_t:chr_file setattr":
--> Can't reproduce an error without this right any more. I'm pretty sure it was needed in the past, see gentoo ticket from link above.

Without any of the permissions of
"allow svirt_t vfio_device_t:chr_file { read write open ioctl }":
error: Failed to start domain web-old
error: internal error: early end of file from monitor: possible problem:

2015-06-07T15:40:47.505774Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: supported
vfio version: 0, reported version: -1
2015-06-07T15:40:47.505814Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: failed to
setup container for group 2
2015-06-07T15:40:47.505835Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: failed to
get group 2
2015-06-07T15:40:47.505858Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: Device
initialization failed.
2015-06-07T15:40:47.505883Z qemu-system-x86_64: -device

vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: Device 'vfio-pci' could not be initialized

diff -ru refpolicy_orig/policy/modules/contrib/virt.te refpolicy/policy/modules/contrib/virt.te

policy/modules/contrib/virt.te +8 -0

@@ -70,6 +70,14 @@
 ## </desc>
 gen_tunable(virt_use_xserver, false)
 
+## <desc>
+###      <p>
+###      Determine whether confined virtual guests
+###      can use vfio for pci device pass through (vt-d).
+###      </p>
+### </desc>
+gen_tunable(virt_use_vfio, false)
+
 attribute virt_ptynode;
 attribute virt_domain;
 attribute virt_image_type;

@@ -340,6 +348,14 @@
 	fs_manage_dos_files(virt_domain)

policy/modules/kernel/devices.if +4 -0

+')
+
+############################
+## <summary>
 ##	Allow read/write the vhost net device
 ## </summary>
 ## <param name="domain">

diff -ru refpolicy_orig/policy/modules/kernel/devices.te refpolicy/policy/modules/kernel/devices.te

policy/modules/kernel/devices.te +3 -0

@@ -273,6 +273,9 @@
 type userio_device_t;
 dev_node(userio_device_t)
 
+type vfio_device_t;
+dev_node(vfio_device_t)
+
 type v4l_device_t;
 dev_node(v4l_device_t)
 

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

The attached patch proposes a way to allow pci device pass through via a new selinux boolean "virt_use_vfio" for libvirt.

This was originally proposed in a slightly different version as gentoo enhancement here: https://bugs.gentoo.org/show_bug.cgi?id=522736
(It's only tested as patch against the gentoo version of the refpoliciy.)

I used it for around one year to pass an ISDN PCIe card to a guest and verified today the function with an USB PCI device. (The ISDN card is no longer in the system.)
USB HUP was ok in guest with lspci and lsusb, but a USB stick did not work as expected. That's not related to selinux and was ignored here, since I have the same problem with selinux in permissive mode on the host.

The patch adds "vfio_device_t;", the boolean virt_use_vfio and when the boolean is set the following rules:

allow virtd_t self:process setrlimit;
allow virtd_t self:capability sys_resource;
allow virtd_t svirt_t:process rlimitinh;
allow virtd_t vfio_device_t:chr_file { relabelfrom setattr }; allow svirt_t vfio_device_t:chr_file { read write open ioctl };

Here the errors I get when I remove one of the rights (keeping all the others in place):

Without "allow virtd_t self:process setrlimit" or "allow virtd_t self:capability sys_resource":
error: Failed to start domain web-old
error: internal error: Process exited prior to exec: libvirt: error :
cannot limit locked memory to 5368709120: Permission denied

Without "allow virtd_t svirt_t:process rlimitinh":
error: Failed to start domain web-old
error: internal error: early end of file from monitor: possible problem:

2015-06-07T14:28:21.433403Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x0, 0xa0000, 0x39030000000) = -12 (Cannot
allocate memory)
2015-06-07T14:28:21.433480Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0xc0000, 0x20000, 0x39144200000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433538Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x100000, 0xdff00000, 0x39030100000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433707Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x100000000, 0x20000000, 0x39110000000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433730Z qemu-system-x86_64: -device

vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1: vfio:

Without "allow virtd_t vfio_device_t:chr_file relabelfrom"
error: Failed to start domain web-old
error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c587,c898' on '/dev/vfio/2':
Permission denied

Without "allow virtd_t vfio_device_t:chr_file setattr":
--> Can't reproduce an error without this right any more. I'm pretty sure it was needed in the past, see gentoo ticket from link above.

Without any of the permissions of
"allow svirt_t vfio_device_t:chr_file { read write open ioctl }":
error: Failed to start domain web-old
error: internal error: early end of file from monitor: possible problem:

2015-06-07T15:40:47.505774Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: supported
vfio version: 0, reported version: -1
2015-06-07T15:40:47.505814Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: failed to
setup container for group 2
2015-06-07T15:40:47.505835Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: failed to
get group 2
2015-06-07T15:40:47.505858Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: Device
initialization failed.
2015-06-07T15:40:47.505883Z qemu-system-x86_64: -device

vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: Device 'vfio-pci' could not be initialized

diff -ru refpolicy_orig/policy/modules/contrib/virt.te refpolicy/policy/modules/contrib/virt.te

policy/modules/contrib/virt.te +16 -0

@@ -70,6 +70,14 @@
 ## </desc>
 gen_tunable(virt_use_xserver, false)
 
+## <desc>
+###      <p>
+###      Determine whether confined virtual guests
+###      can use vfio for pci device pass through (vt-d).
+###      </p>
+### </desc>
+gen_tunable(virt_use_vfio, false)
+
 attribute virt_ptynode;
 attribute virt_domain;
 attribute virt_image_type;

@@ -340,6 +348,14 @@
 	fs_manage_dos_files(virt_domain)
 ')
 
+tunable_policy(`virt_use_vfio',`
+	dev_rw_vfio_dev(svirt_t)
+	dev_trans_vfio_dev(virtd_t)
+	allow virtd_t self:process setrlimit;
+	allow virtd_t self:capability sys_resource;
+	allow virtd_t svirt_t:process rlimitinh;
+')
+
 optional_policy(`
 	tunable_policy(`virt_use_xserver',`
 		xserver_read_xdm_pid(virt_domain)

diff -ru refpolicy_orig/policy/modules/kernel/devices.fc refpolicy/policy/modules/kernel/devices.fc

policy/modules/kernel/devices.fc +1 -0

@@ -118,6 +118,7 @@
 ifdef(`distro_suse', `
 /dev/usbscanner		-c	gen_context(system_u:object_r:scanner_device_t,s0)
 ')
+/dev/vfio/(vfio)?[0-9]* -c      gen_context(system_u:object_r:vfio_device_t,s0)
 /dev/vhost-net		-c	gen_context(system_u:object_r:vhost_device_t,s0)
 /dev/vbi.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/vbox.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)

diff -ru refpolicy_orig/policy/modules/kernel/devices.if refpolicy/policy/modules/kernel/devices.if

policy/modules/kernel/devices.if +36 -0

@@ -4611,6 +4611,42 @@
 
 ########################################
 ## <summary>
+##      Allow libvirt to use vfio for vt-d passthrough
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`dev_rw_vfio_dev',`
+	gen_require(`
+		type device_t, vfio_device_t;
+	')
+
+	allow $1 vfio_device_t:chr_file { read write open ioctl };
+')
+
+########################################
+## <summary>
+##      Allow dev file transition to new user and type
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`dev_trans_vfio_dev',`
+	gen_require(`
+		type device_t, vfio_device_t;
+	')
+
+	allow $1 vfio_device_t:chr_file { relabelfrom setattr };
+')
+
+############################
+## <summary>
 ##	Allow read/write the vhost net device
 ## </summary>
 ## <param name="domain">

diff -ru refpolicy_orig/policy/modules/kernel/devices.te refpolicy/policy/modules/kernel/devices.te

policy/modules/kernel/devices.te +3 -0

@@ -273,6 +273,9 @@
 type userio_device_t;
 dev_node(userio_device_t)
 
+type vfio_device_t;
+dev_node(vfio_device_t)
+
 type v4l_device_t;
 dev_node(v4l_device_t)
 

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

The attached patch proposes a way to allow pci device pass through via a new selinux boolean "virt_use_vfio" for libvirt.

This was originally proposed in a slightly different version as gentoo enhancement here: https://bugs.gentoo.org/show_bug.cgi?id=522736
(It's only tested as patch against the gentoo version of the refpoliciy.)

I used it for around one year to pass an ISDN PCIe card to a guest and verified today the function with an USB PCI device. (The ISDN card is no longer in the system.)
USB HUP was ok in guest with lspci and lsusb, but a USB stick did not work as expected. That's not related to selinux and was ignored here, since I have the same problem with selinux in permissive mode on the host.

The patch adds "vfio_device_t;", the boolean virt_use_vfio and when the boolean is set the following rules:

allow virtd_t self:process setrlimit;
allow virtd_t self:capability sys_resource;
allow virtd_t svirt_t:process rlimitinh;
allow virtd_t vfio_device_t:chr_file { relabelfrom setattr }; allow svirt_t vfio_device_t:chr_file { read write open ioctl };

Here the errors I get when I remove one of the rights (keeping all the others in place):

Without "allow virtd_t self:process setrlimit" or "allow virtd_t self:capability sys_resource":
error: Failed to start domain web-old
error: internal error: Process exited prior to exec: libvirt: error :
cannot limit locked memory to 5368709120: Permission denied

Without "allow virtd_t svirt_t:process rlimitinh":
error: Failed to start domain web-old
error: internal error: early end of file from monitor: possible problem:

2015-06-07T14:28:21.433403Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x0, 0xa0000, 0x39030000000) = -12 (Cannot
allocate memory)
2015-06-07T14:28:21.433480Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0xc0000, 0x20000, 0x39144200000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433538Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x100000, 0xdff00000, 0x39030100000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433707Z qemu-system-x86_64: -device
vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1:
vfio_dma_map(0x3ebad4fcd0, 0x100000000, 0x20000000, 0x39110000000) = -12
(Cannot allocate memory)
2015-06-07T14:28:21.433730Z qemu-system-x86_64: -device

vfio-pci,host=00:1d.0,id=hostdev0,bus=pci.0,addr=0xd,rombar=1: vfio:

Without "allow virtd_t vfio_device_t:chr_file relabelfrom"
error: Failed to start domain web-old
error: unable to set security context 'system_u:object_r:svirt_image_t:s0:c587,c898' on '/dev/vfio/2':
Permission denied

Without "allow virtd_t vfio_device_t:chr_file setattr":
--> Can't reproduce an error without this right any more. I'm pretty sure it was needed in the past, see gentoo ticket from link above.

Without any of the permissions of
"allow svirt_t vfio_device_t:chr_file { read write open ioctl }":
error: Failed to start domain web-old
error: internal error: early end of file from monitor: possible problem:

2015-06-07T15:40:47.505774Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: supported
vfio version: 0, reported version: -1
2015-06-07T15:40:47.505814Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: failed to
setup container for group 2
2015-06-07T15:40:47.505835Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: vfio: failed to
get group 2
2015-06-07T15:40:47.505858Z qemu-system-x86_64: -device
vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: Device
initialization failed.
2015-06-07T15:40:47.505883Z qemu-system-x86_64: -device

vfio-pci,host=00:1a.0,id=hostdev0,bus=pci.0,addr=0xd: Device 'vfio-pci' could not be initialized

diff -ru refpolicy_orig/policy/modules/contrib/virt.te refpolicy/policy/modules/contrib/virt.te

policy/modules/contrib/virt.te +16 -0

@@ -70,6 +70,14 @@
 ## </desc>
 gen_tunable(virt_use_xserver, false)
 
+## <desc>
+###      <p>
+###      Determine whether confined virtual guests
+###      can use vfio for pci device pass through (vt-d).
+###      </p>
+### </desc>
+gen_tunable(virt_use_vfio, false)
+
 attribute virt_ptynode;
 attribute virt_domain;
 attribute virt_image_type;

@@ -340,6 +348,14 @@
 	fs_manage_dos_files(virt_domain)
 ')
 
+tunable_policy(`virt_use_vfio',`
+	dev_rw_vfio_dev(svirt_t)
+	dev_trans_vfio_dev(virtd_t)
+	allow virtd_t self:process setrlimit;
+	allow virtd_t self:capability sys_resource;
+	allow virtd_t svirt_t:process rlimitinh;
+')
+
 optional_policy(`
 	tunable_policy(`virt_use_xserver',`
 		xserver_read_xdm_pid(virt_domain)

diff -ru refpolicy_orig/policy/modules/kernel/devices.fc refpolicy/policy/modules/kernel/devices.fc

policy/modules/kernel/devices.fc +1 -0

@@ -118,6 +118,7 @@
 ifdef(`distro_suse', `
 /dev/usbscanner		-c	gen_context(system_u:object_r:scanner_device_t,s0)
 ')
+/dev/vfio/(vfio)?[0-9]* -c      gen_context(system_u:object_r:vfio_device_t,s0)
 /dev/vhost-net		-c	gen_context(system_u:object_r:vhost_device_t,s0)
 /dev/vbi.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/vbox.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)

diff -ru refpolicy_orig/policy/modules/kernel/devices.if refpolicy/policy/modules/kernel/devices.if

policy/modules/kernel/devices.if +36 -0

@@ -4611,6 +4611,42 @@
 
 ########################################
 ## <summary>
+##      Allow libvirt to use vfio for vt-d passthrough
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`dev_rw_vfio_dev',`
+	gen_require(`
+		type device_t, vfio_device_t;
+	')
+
+	allow $1 vfio_device_t:chr_file { read write open ioctl };
+')
+
+########################################
+## <summary>
+##      Allow dev file transition to new user and type
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`dev_trans_vfio_dev',`
+	gen_require(`
+		type device_t, vfio_device_t;
+	')
+
+	allow $1 vfio_device_t:chr_file { relabelfrom setattr };
+')
+
+############################
+## <summary>
 ##	Allow read/write the vhost net device
 ## </summary>
 ## <param name="domain">

diff -ru refpolicy_orig/policy/modules/kernel/devices.te refpolicy/policy/modules/kernel/devices.te

policy/modules/kernel/devices.te +3 -0

@@ -273,6 +273,9 @@
 type userio_device_t;
 dev_node(userio_device_t)
 
+type vfio_device_t;
+dev_node(vfio_device_t)
+
 type v4l_device_t;
 dev_node(v4l_device_t)
 

_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

I've changed the patch as outlined, I hope it's correct now...

Since it's working now without
"allow virtd_t vfio_device_t:chr_file setattr;"
I've also dropped that from the patch.

Since the virt module is in the contrib submodule I had to split this in two patches, or at least I see no way to do that in one git patch.

From 631ba532a733c20965b63fbe1a4e4217c1bb303b Mon Sep 17 00:00:00 2001
From: Alexander Wetzel <[email protected]>
Date: Mon, 8 Jun 2015 21:36:45 +0200
Subject: [PATCH 1/1] adds vfio device support to base policy

Signed-off-by Alexander Wetzel <[email protected]>

---
 policy/modules/kernel/devices.fc |  1 +
 policy/modules/kernel/devices.if | 36 ++++++++++++++++++++++++++++++++++++
 policy/modules/kernel/devices.te |  3 +++
 3 files changed, 40 insertions(+)

policy/modules/kernel/devices.fc +1 -0

index d6ebfcd..a33e395 100644
@@ -118,6 +118,7 @@
 ifdef(`distro_suse', `
 /dev/usbscanner		-c	gen_context(system_u:object_r:scanner_device_t,s0)
 ')
+/dev/vfio/.+		-c      gen_context(system_u:object_r:vfio_device_t,s0)
 /dev/vhost-net		-c	gen_context(system_u:object_r:vhost_device_t,s0)
 /dev/vbi.*		-c	gen_context(system_u:object_r:v4l_device_t,s0)
 /dev/vbox.*		-c	gen_context(system_u:object_r:xserver_misc_device_t,s0)

policy/modules/kernel/devices.if +36 -0

index 9744d63..3b904d7 100644
@@ -4611,6 +4611,42 @@ interface(`dev_write_video_dev',`
 
 ########################################
 ## <summary>
+##      Read and write vfio devices.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`dev_rw_vfio_dev',`
+	gen_require(`
+		type device_t, vfio_device_t;
+	')
+
+	rw_chr_files_pattern($1, device_t, vfio_device_t)
+')
+
+########################################
+## <summary>
+##      Relabel vfio devices.
+## </summary>
+## <param name="domain">
+##      <summary>
+##      Domain allowed access.
+##      </summary>
+## </param>
+#
+interface(`dev_relabelfrom_vfio_dev',`
+	gen_require(`
+		type device_t, vfio_device_t;
+	')
+
+	relabelfrom_chr_files_pattern($1, device_t, vfio_device_t)
+')
+
+############################
+## <summary>
 ##	Allow read/write the vhost net device
 ## </summary>
 ## <param name="domain">

policy/modules/kernel/devices.te +3 -0

index 166c8f7..eb12597 100644
@@ -273,6 +273,9 @@ dev_node(usbmon_device_t)
 type userio_device_t;
 dev_node(userio_device_t)
 
+type vfio_device_t;
+dev_node(vfio_device_t)
+
 type v4l_device_t;
 dev_node(v4l_device_t)
 

Signature · 12 lines

2.4.0


From de1c81974a3247d3ceb3b41af869d93948a9fdf1 Mon Sep 17 00:00:00 2001
From: Alexander Wetzel <[email protected]>
Date: Mon, 8 Jun 2015 22:52:31 +0200
Subject: [PATCH 1/1] add vfio support for libvirt

Signed-off-by: Alexander Wetzel <[email protected]>
---
 virt.te | 19 +++++++++++++++++++
 1 file changed, 19 insertions(+)

virt.te +19 -0

index f8a59e4..f512ddc 100644
@@ -70,6 +70,14 @@ gen_tunable(virt_use_usb, false)
 ## </desc>
 gen_tunable(virt_use_xserver, false)
 
+## <desc>
+###      <p>
+###      Determine whether confined virtual guests
+###      can use vfio for pci device pass through (vt-d).
+###      </p>
+### </desc>
+gen_tunable(virt_use_vfio, false)
+
 attribute virt_ptynode;
 attribute virt_domain;
 attribute virt_image_type;

@@ -415,6 +423,10 @@ corenet_tcp_bind_all_ports(svirt_t)
 corenet_sendrecv_all_client_packets(svirt_t)
 corenet_tcp_connect_all_ports(svirt_t)
 
+tunable_policy(`virt_use_vfio',`
+	dev_rw_vfio_dev(svirt_t)
+')
+
 ########################################
 #
 # virtd local policy

@@ -658,6 +670,13 @@ tunable_policy(`virt_use_samba',`
 	fs_read_cifs_symlinks(virtd_t)
 ')
 
+tunable_policy(`virt_use_vfio',`
+	allow virtd_t self:capability sys_resource;
+	allow virtd_t self:process setrlimit;
+	allow virtd_t svirt_t:process rlimitinh;
+	dev_relabelfrom_vfio_dev(virtd_t)
+')
+
 optional_policy(`
 	brctl_domtrans(virtd_t)
 ')

Signature · 7 lines

2.4.0


_______________________________________________
refpolicy mailing list
refpolicy at oss.tresys.com
http://oss.tresys.com/mailman/listinfo/refpolicy

Quoted 3 lines

Since it's working now without
"allow virtd_t vfio_device_t:chr_file setattr;"
I've also dropped that from the patch.

I wonder what that is all about. Back when i was using this functionality this only worked with root UID. I wonder if that is still the case. Maybe it now works with unprivilege UID and it may need to set attributes in that scenario.

Quoted 6 lines

Quoted 3 lines

Since it's working now without
"allow virtd_t vfio_device_t:chr_file setattr;"
I've also dropped that from the patch.

I wonder what that is all about. Back when i was using this functionality this only worked with root UID. I wonder if that is still the case. Maybe it now works with unprivilege UID and it may need to set attributes in that scenario.

I may mix it up after all the time since checking the documentation, but for my understanding vfio is the "new" device passthrough, which no longer needs root privileges. The virtual test instance is running with the user qemu and the /dev/vfio/2 device created for the passthrough is also owned by qemu:

# ls -lZ /dev/vfio/
total 0
crw-------. 1 qemu qemu system_u:object_r:svirt_image_t:s0:c412,c565 248,   0 Jun  8 15:44 2
crw-rw-rw-. 1 root root system_u:object_r:vfio_device_t:s0            10, 196 Jun  7 22:08 vfio

Nevertheless I do not need setattr any longer, sesearch is not finding any rule for that but it's still working.