On Thu, Nov 10, 2016 at 10:35:46AM +0000, Marc-André Lureau wrote: > Hi > > What's the status with this patch? If I understand the discussion, it is > needed, but not enough. Now that SELinux has been fixed (both in f24/f25 > now), I can see only the ACL left: setfacl -m u:qemu:rw /dev/dri/renderD128 > + this patch allows me to setup a system VM with virgl. (though tbh, I > would be fine restricting virgl to qemu:///session only) This ties in with the discussion we've just been having around udev and DAC/MAC labelling of device nodes. With my proposed solution of using a new mount namespace + dedicated /dev per VM, then granting DAC access to the DRI nodes is easy. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://entangle-photo.org -o- http://search.cpan.org/~danberr/ :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
