qemu-cgroup: allow accel rendernode access

Signed-off-by: NMarc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: NJán Tomko <jtomko@redhat.com>

src/qemu/qemu_cgroup.c

@@ -503,6 +503,29 @@ qemuSetupGraphicsCgroup(virDomainObjPtr vm,
 }
 
 
+static int
+qemuSetupVideoCgroup(virDomainObjPtr vm,
+                     virDomainVideoDefPtr def)
+{
+    qemuDomainObjPrivatePtr priv = vm->privateData;
+    virDomainVideoAccelDefPtr accel = def->accel;
+    int ret;
+
+    if (!accel)
+        return 0;
+
+    if (!accel->rendernode ||
+        !virCgroupHasController(priv->cgroup, VIR_CGROUP_CONTROLLER_DEVICES))
+        return 0;
+
+    ret = virCgroupAllowDevicePath(priv->cgroup, accel->rendernode,
+                                   VIR_CGROUP_DEVICE_RW, false);
+    virDomainAuditCgroupPath(vm, priv->cgroup, "allow", accel->rendernode,
+                             "rw", ret);
+    return ret;
+}
+
+
 static int
 qemuSetupBlkioCgroup(virDomainObjPtr vm)
 {
@@ -803,6 +826,11 @@ qemuSetupDevicesCgroup(virDomainObjPtr vm)
             goto cleanup;
     }
 
+    for (i = 0; i < vm->def->nvideos; i++) {
+        if (qemuSetupVideoCgroup(vm, vm->def->videos[i]) < 0)
+            goto cleanup;
+    }
+
     for (i = 0; i < vm->def->ninputs; i++) {
         if (qemuSetupInputCgroup(vm, vm->def->inputs[i]) < 0)
             goto cleanup;