Re: [libvirt] [PATCH 4/4] qemu: add VFIO devices to cgroup ACL

> We manage perfectly well to configure ACLs for individual disks that > a VM is given without having to wildcard allow every single /dev/sdN > disk. That fact that you were able to make the security drivers label > the /dev/vfio/n devices correctly, shows that the information required > is available. So why can't you set the cgroups ACLs correctly here too ? > There's no need to move cgroups code into any security driver. > Sorry, my brain combined the first and second sentences of your message, and understood that you wanted this to happen in the security driver. I'll look up what's done for disks.