From: Michael Tokarev <mjt@tls.msk.ru>
To: Lutz Vieweg <lvml@5t9.de>
Cc: qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] vhost broken?
Date: Sat, 21 Jan 2012 14:06:56 +0400 [thread overview]
Message-ID: <4F1A8E40.5030201@msgid.tls.msk.ru> (raw)
In-Reply-To: <jfcotf$4j4$1@dough.gmane.org>
On 21.01.2012 02:13, Lutz Vieweg wrote:
> On 01/05/2012 04:00 PM, Michael S. Tsirkin wrote:
>> Just chmod /dev/vhost-net to allow access
>
> I wonder whether it's considered a security risk to allow non-root
> users access to /dev/vhost-net?
>
> (Or is there a way to have root prepare limited use of vhost for only
> some users or some network devices?)
Usual idiom is to create a dedicated group, chgrp
/dev/vhost-net to this group and add g+rw permission.
That lets you to add users to that group to grant them
access.
Initially it was believed that /dev/kvm poses no security
implications whatsoever and can be mode 0666. But later
on several security bugs has been discovered in this
subsystem, so it is a good idea to not grant extra
privileges by default.
/mjt
prev parent reply other threads:[~2012-01-21 10:07 UTC|newest]
Thread overview: 7+ messages / expand[flat|nested] mbox.gz Atom feed top
2012-01-05 11:05 [Qemu-devel] vhost broken? Gerd Hoffmann
2012-01-05 11:16 ` Avi Kivity
2012-01-05 11:33 ` Gerd Hoffmann
2012-01-05 11:37 ` Daniel P. Berrange
2012-01-05 15:00 ` Michael S. Tsirkin
2012-01-20 22:13 ` Lutz Vieweg
2012-01-21 10:06 ` Michael Tokarev [this message]
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4F1A8E40.5030201@msgid.tls.msk.ru \
--to=mjt@tls.msk.ru \
--cc=lvml@5t9.de \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.