> libvirt uses cgroups to restrict qemu. You can tweak cgroup_controllers > in /etc/libvirt/qemu.conf, when you remove "devices" controller it > should work (unless something else like selinux or apparmor applies > additional restrictions). > > HTH, > Gerd
like this? # What cgroup controllers to make use of with QEMU guests # # - 'cpu' - use for schedular tunables # - 'devices' - use for device whitelisting # - 'memory' - use for memory tunables # - 'blkio' - use for block devices I/O tunables # - 'cpuset' - use for CPUs and memory nodes # - 'cpuacct' - use for CPUs statistics. # # NB, even if configured here, they won't be used unless # the administrator has mounted cgroups, e.g.: # # mkdir /dev/cgroup # mount -t cgroup -o devices,cpu,memory,blkio,cpuset none /dev/cgroup # # They can be mounted anywhere, and different controllers # can be mounted in different locations. libvirt will detect # where they are located. # cgroup_controllers = [ "cpu", "memory", "blkio", "cpuset", "cpuacct" ] my original cgroup_controllers is commented #cgroup_controllers = [ "cpu", "devices", "memory", "blkio", "cpuset", "cpuacct" ] greetings
