The cgroups ACL code was only allowing the primary disk image. It is possible to chain images together, so we need to search for backing stores and add them to the ACL too. Since the ACL only handles block devices, we ignore the EINVAL we get from plain files. * src/qemu/qemu_driver.c: Allow backing stores in cgroup ACLs --- src/qemu/qemu_driver.c | 47 +++++++++++++++++++++++++++++++++++------------ 1 files changed, 35 insertions(+), 12 deletions(-) diff --git a/src/qemu/qemu_driver.c b/src/qemu/qemu_driver.c index 326cb58..ae6addd 100644 --- a/src/qemu/qemu_driver.c +++ b/src/qemu/qemu_driver.c @@ -84,6 +84,7 @@ #include "macvtap.h" #include "nwfilter/nwfilter_gentech_driver.h" #include "hooks.h" +#include "storage_file.h" #define VIR_FROM_THIS VIR_FROM_QEMU @@ -2957,18 +2958,40 @@ static int qemuSetupCgroup(struct qemud_driver *driver, } for (i = 0; i < vm->def->ndisks ; i++) { - if (vm->def->disks[i]->type != VIR_DOMAIN_DISK_TYPE_BLOCK || - vm->def->disks[i]->src == NULL) - continue; + char *path = vm->def->disks[i]->src; + while (path != NULL) { + virStorageFileMetadata meta; + int ret; + + VIR_DEBUG("Process path %s for disk %d", path, i); + rc = virCgroupAllowDevicePath(cgroup, path); + if (rc != 0) { + /* Get this for non-block devices */ + if (rc == -EINVAL) { + VIR_DEBUG("Ignoring EINVAL for %s", path); + } else { + virReportSystemError(-rc, + _("Unable to allow device %s for %s"), + path, vm->def->name); + if (path != vm->def->disks[i]->src) + VIR_FREE(path); + goto cleanup; + } + } - rc = virCgroupAllowDevicePath(cgroup, - vm->def->disks[i]->src); - if (rc != 0) { - virReportSystemError(-rc, - _("Unable to allow device %s for %s"), - vm->def->disks[i]->src, vm->def->name); - goto cleanup; - } + memset(&meta, 0, sizeof(meta)); + + ret = virStorageFileGetMetadata(path, &meta); + + if (path != vm->def->disks[i]->src) + VIR_FREE(path); + path = NULL; + + if (ret < 0) + goto cleanup; + + path = meta.backingStore; + } while (path != NULL); } rc = virCgroupAllowDeviceMajor(cgroup, 'c', DEVICE_PTY_MAJOR); -- 1.6.5.2