[PATCH] apparmor: Allow vfio-ccw hostdev sysfs access
Attaching a vfio-ccw mediated device as a <hostdev> fails under the libvirt-qemu AppArmor profile because QEMU's channel subsystem code (hw/s390x/css.c) reads several sysfs attributes of the passed-through subchannel when building the guest SCHIB, and the profile does not grant read access to them: css_sch_get_chpids() -> /sys/bus/css/devices/<id>/chpids css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type The first two are opened via /sys/bus/css/devices/<id> symlinks, which AppArmor resolves to the real device path /sys/devices/css<n>/<id>/ before mediating the access; the CHPID type file is read directly under /sys/devices/. Without these rules the attach (or hotplug) fails with an AppArmor DENIED message and QEMU aborts with: s390_ccw_realize: Failed to build initial schib: Invalid argument Add narrowly-scoped read rules for these three files so vfio-ccw passthrough works without granting broad access to /sys/devices/css*. Signed-off-by: Hector Cao <hector.cao@canonical.com> --- src/security/apparmor/libvirt-qemu | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index e4aceacd70..428f9a9731 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -50,6 +50,16 @@ /run/udev/data/c16[6,7]* r, /run/udev/data/c18[0,8,9]* r, + # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads + # the channel-path masks, CHPID list and CHPID type of the passed-through + # subchannel from sysfs when building the guest SCHIB. The chpids and + # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that + # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read + # directly from /sys/devices/cssN/chp0.<chpid>/. + /sys/devices/css[0-9]*/*/chpids r, + /sys/devices/css[0-9]*/*/pimpampom r, + /sys/devices/css[0-9]*/chp0.*/type r, + # WARNING: this gives the guest direct access to host hardware and specific # portions of shared memory. This is required for sound using ALSA with kvm, # but may constitute a security risk. If your environment does not require -- 2.43.0
On Tue, Aug 11, 2026 at 14:52:38 +0200, Hector Cao via Devel wrote:
Attaching a vfio-ccw mediated device as a <hostdev> fails under the libvirt-qemu AppArmor profile because QEMU's channel subsystem code (hw/s390x/css.c) reads several sysfs attributes of the passed-through subchannel when building the guest SCHIB, and the profile does not grant read access to them:
css_sch_get_chpids() -> /sys/bus/css/devices/<id>/chpids css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type
The first two are opened via /sys/bus/css/devices/<id> symlinks, which AppArmor resolves to the real device path /sys/devices/css<n>/<id>/ before mediating the access; the CHPID type file is read directly under /sys/devices/. Without these rules the attach (or hotplug) fails with an AppArmor DENIED message and QEMU aborts with:
s390_ccw_realize: Failed to build initial schib: Invalid argument
Add narrowly-scoped read rules for these three files so vfio-ccw passthrough works without granting broad access to /sys/devices/css*.
Signed-off-by: Hector Cao <hector.cao@canonical.com> --- src/security/apparmor/libvirt-qemu | 10 ++++++++++ 1 file changed, 10 insertions(+)
diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu index e4aceacd70..428f9a9731 100644 --- a/src/security/apparmor/libvirt-qemu +++ b/src/security/apparmor/libvirt-qemu @@ -50,6 +50,16 @@ /run/udev/data/c16[6,7]* r, /run/udev/data/c18[0,8,9]* r,
+ # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads + # the channel-path masks, CHPID list and CHPID type of the passed-through + # subchannel from sysfs when building the guest SCHIB. The chpids and + # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that + # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read + # directly from /sys/devices/cssN/chp0.<chpid>/. + /sys/devices/css[0-9]*/*/chpids r, + /sys/devices/css[0-9]*/*/pimpampom r, + /sys/devices/css[0-9]*/chp0.*/type r, + # WARNING: this gives the guest direct access to host hardware and specific # portions of shared memory. This is required for sound using ALSA with kvm, # but may constitute a security risk. If your environment does not require -- 2.43.0
While I personally don't care about s390x, since nobody objected and this adds just read access: Reviewed-by: Peter Krempa <pkrempa@redhat.com> and I'll push this shortly
For any next submission please configure your git to format the extra 'From' header as the mailing list munges you sender address due to DMARC. I've fixed it for this patch by using the address from your sign-off
participants (2)
-
Hector Cao -
Peter Krempa