Attaching a vfio-ccw mediated device as a <hostdev> fails under the
libvirt-qemu AppArmor profile because QEMU's channel subsystem code
(hw/s390x/css.c) reads several sysfs attributes of the passed-through
subchannel when building the guest SCHIB, and the profile does not grant
read access to them:

  css_sch_get_chpids()     -> /sys/bus/css/devices/<id>/chpids
  css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom
  css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type

The first two are opened via /sys/bus/css/devices/<id> symlinks, which
AppArmor resolves to the real device path /sys/devices/css<n>/<id>/
before mediating the access; the CHPID type file is read directly under
/sys/devices/. Without these rules the attach (or hotplug) fails with an
AppArmor DENIED message and QEMU aborts with:

  s390_ccw_realize: Failed to build initial schib: Invalid argument

Add narrowly-scoped read rules for these three files so vfio-ccw
passthrough works without granting broad access to /sys/devices/css*.

Signed-off-by: Hector Cao <hector.cao@canonical.com>
---
 src/security/apparmor/libvirt-qemu | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
index e4aceacd70..428f9a9731 100644
--- a/src/security/apparmor/libvirt-qemu
+++ b/src/security/apparmor/libvirt-qemu
@@ -50,6 +50,16 @@
   /run/udev/data/c16[6,7]* r,
   /run/udev/data/c18[0,8,9]* r,
 
+  # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads
+  # the channel-path masks, CHPID list and CHPID type of the passed-through
+  # subchannel from sysfs when building the guest SCHIB. The chpids and
+  # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that
+  # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read
+  # directly from /sys/devices/cssN/chp0.<chpid>/.
+  /sys/devices/css[0-9]*/*/chpids r,
+  /sys/devices/css[0-9]*/*/pimpampom r,
+  /sys/devices/css[0-9]*/chp0.*/type r,
+
   # WARNING: this gives the guest direct access to host hardware and specific
   # portions of shared memory. This is required for sound using ALSA with kvm,
   # but may constitute a security risk. If your environment does not require
-- 
2.43.0

For any next submission please configure your git to format the extra
'From' header as the mailing list munges you sender address due to
DMARC.

I've fixed it for this patch by using the address from your sign-off

On Tue, Aug 11, 2026 at 14:52:38 +0200, Hector Cao via Devel wrote:
> Attaching a vfio-ccw mediated device as a <hostdev> fails under the
> libvirt-qemu AppArmor profile because QEMU's channel subsystem code
> (hw/s390x/css.c) reads several sysfs attributes of the passed-through
> subchannel when building the guest SCHIB, and the profile does not grant
> read access to them:
> 
>   css_sch_get_chpids()     -> /sys/bus/css/devices/<id>/chpids
>   css_sch_get_path_masks() -> /sys/bus/css/devices/<id>/pimpampom
>   css_sch_get_chpid_type() -> /sys/devices/css<n>/chp0.<chpid>/type
> 
> The first two are opened via /sys/bus/css/devices/<id> symlinks, which
> AppArmor resolves to the real device path /sys/devices/css<n>/<id>/
> before mediating the access; the CHPID type file is read directly under
> /sys/devices/. Without these rules the attach (or hotplug) fails with an
> AppArmor DENIED message and QEMU aborts with:
> 
>   s390_ccw_realize: Failed to build initial schib: Invalid argument
> 
> Add narrowly-scoped read rules for these three files so vfio-ccw
> passthrough works without granting broad access to /sys/devices/css*.
> 
> Signed-off-by: Hector Cao <hector.cao@canonical.com>
> ---
>  src/security/apparmor/libvirt-qemu | 10 ++++++++++
>  1 file changed, 10 insertions(+)
> 
> diff --git a/src/security/apparmor/libvirt-qemu b/src/security/apparmor/libvirt-qemu
> index e4aceacd70..428f9a9731 100644
> --- a/src/security/apparmor/libvirt-qemu
> +++ b/src/security/apparmor/libvirt-qemu
> @@ -50,6 +50,16 @@
>    /run/udev/data/c16[6,7]* r,
>    /run/udev/data/c18[0,8,9]* r,
>  
> +  # For vfio-ccw (s390x channel subsystem) hostdev passthrough. QEMU reads
> +  # the channel-path masks, CHPID list and CHPID type of the passed-through
> +  # subchannel from sysfs when building the guest SCHIB. The chpids and
> +  # pimpampom files are opened via /sys/bus/css/devices/<id>/ symlinks that
> +  # AppArmor resolves to /sys/devices/cssN/<id>/; the CHPID type is read
> +  # directly from /sys/devices/cssN/chp0.<chpid>/.
> +  /sys/devices/css[0-9]*/*/chpids r,
> +  /sys/devices/css[0-9]*/*/pimpampom r,
> +  /sys/devices/css[0-9]*/chp0.*/type r,
> +
>    # WARNING: this gives the guest direct access to host hardware and specific
>    # portions of shared memory. This is required for sound using ALSA with kvm,
>    # but may constitute a security risk. If your environment does not require
> -- 
> 2.43.0
> 

While I personally don't care about s390x, since nobody objected and
this adds just read access:

Reviewed-by: Peter Krempa <pkrempa@redhat.com>

and I'll push this shortly