[PATCH] kvm: remove CAP_SYS_RAWIO requirement from kvm_vm_ioctl_assign_irq

[PATCH] kvm: remove CAP_SYS_RAWIO requirement from kvm_vm_ioctl_assign_irq

[Alex Williamson]

Remove this check in an effort to allow kvm guests to run without
root privileges.  This capability check doesn't seem to add any
security since the device needs to have already been added via the
assign device ioctl and the io actually occurs through the pci
sysfs interface.

Signed-off-by: Alex Williamson <alex.williamson@redhat.com>
---

 virt/kvm/assigned-dev.c |    3 ---
 1 files changed, 0 insertions(+), 3 deletions(-)

diff --git a/virt/kvm/assigned-dev.c b/virt/kvm/assigned-dev.c
index 4d10b1e..64672e2 100644
--- a/virt/kvm/assigned-dev.c
+++ b/virt/kvm/assigned-dev.c
@@ -448,9 +448,6 @@ static int kvm_vm_ioctl_assign_irq(struct kvm *kvm,
 	struct kvm_assigned_dev_kernel *match;
 	unsigned long host_irq_type, guest_irq_type;
 
-	if (!capable(CAP_SYS_RAWIO))
-		return -EPERM;
-
 	if (!irqchip_in_kernel(kvm))
 		return r;
 

Re: [PATCH] kvm: remove CAP_SYS_RAWIO requirement from kvm_vm_ioctl_assign_irq

[Chris Wright]

* Alex Williamson (alex.williamson@redhat.com) wrote:
> Remove this check in an effort to allow kvm guests to run without
> root privileges.  This capability check doesn't seem to add any
> security since the device needs to have already been added via the
> assign device ioctl and the io actually occurs through the pci
> sysfs interface.

Right, so irq resource allocation can't be directly abused (by calling
this ioctl out of order, for example) because the device must be assigned
first via kvm_vm_ioctl_assign_device().  My only concern isn't with this
patch per-se, but the exising kvm_vm_ioctl_assign_device().

thanks,
-chris

Re: [PATCH] kvm: remove CAP_SYS_RAWIO requirement from kvm_vm_ioctl_assign_irq

[Alex Williamson]

On Thu, 2010-05-13 at 15:06 -0700, Chris Wright wrote:
> * Alex Williamson (alex.williamson@redhat.com) wrote:
> > Remove this check in an effort to allow kvm guests to run without
> > root privileges.  This capability check doesn't seem to add any
> > security since the device needs to have already been added via the
> > assign device ioctl and the io actually occurs through the pci
> > sysfs interface.
> 
> Right, so irq resource allocation can't be directly abused (by calling
> this ioctl out of order, for example) because the device must be assigned
> first via kvm_vm_ioctl_assign_device().  My only concern isn't with this
> patch per-se, but the exising kvm_vm_ioctl_assign_device().

Yep, I agree.  How do we decide the caller of the assign device ioctl
has sufficient rights to the device without introducing another
capabilities check?  We won't get far if the resources are already
claimed by a running driver, but we don't necessarily want anyone
with /dev/kvm rights to be able to grab the remaining devices in the
system.

Alex

Re: [PATCH] kvm: remove CAP_SYS_RAWIO requirement from kvm_vm_ioctl_assign_irq

[Marcelo Tosatti]

On Wed, May 12, 2010 at 09:46:31AM -0400, Alex Williamson wrote:
> Remove this check in an effort to allow kvm guests to run without
> root privileges.  This capability check doesn't seem to add any
> security since the device needs to have already been added via the
> assign device ioctl and the io actually occurs through the pci
> sysfs interface.
> 
> Signed-off-by: Alex Williamson <alex.williamson@redhat.com>

Applied, thanks.