On Tue, Aug 11, 2026 at 14:52:38 +0200, Hector Cao via Devel wrote:
Attaching a vfio-ccw mediated device as a <hostdev> fails under the libvirt-qemu AppArmor profile because QEMU's channel subsystem code (hw/s390x/css.c) reads several sysfs attributes of the passed-through subchannel when building the guest SCHIB, and the profile does not grant read access to them:
css_sch_get_chpids() -> /sys/bus/css/devices/<id>/chpids css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type
The first two are opened via /sys/bus/css/devices/<id> symlinks, which AppArmor resolves to the real device path /sys/devices/css<n>/<id>/ before mediating the access; the CHPID type file is read directly under /sys/devices/. Without these rules the attach (or hotplug) fails with an AppArmor DENIED message and QEMU aborts with:
s390_ccw_realize: Failed to build initial schib: Invalid argument
Add narrowly-scoped read rules for these three files so vfio-ccw passthrough works without granting broad access to /sys/devices/css*.
Signed-off-by: Hector Cao <hector.cao@canonical.com> --- src/security/apparmor/libvirt-qemu | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index e4aceacd70..428f9a9731 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -50,6 +50,16 @@ /run/udev/data/c16[6,7]* r, /run/udev/data/c18[0,8,9]* r,
+ # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads + # the channel-path masks, CHPID list and CHPID type of the passed-through + # subchannel from sysfs when building the guest SCHIB. The chpids and + # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that + # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read + # directly from /sys/devices/cssN/chp0.<chpid>/. + /sys/devices/css[0-9]*/*/chpids r, + /sys/devices/css[0-9]*/*/pimpampom r, + /sys/devices/css[0-9]*/chp0.*/type r, + # WARNING: this gives the guest direct access to host hardware and specific # portions of shared memory. This is required for sound using ALSA with kvm, # but may constitute a security risk. If your environment does not require -- 2.43.0
While I personally don't care about s390x, since nobody objected and this adds just read access: Reviewed-by: Peter Krempa <pkrempa@redhat.com> and I'll push this shortly