[PATCH] KVM: Device assignment: Check for privileges before assigning irq

[PATCH] KVM: Device assignment: Check for privileges before assigning irq

[Amit Shah]

Even though we don't share irqs at the moment, we should ensure
regular user processes don't try to allocate system resources.

We check for capability to access IO devices (CAP_SYS_RAWIO) before
we request_irq on behalf of the guest.

Noticed by Avi.

Signed-off-by: Amit Shah <amit.shah@qumranet.com>
---
 arch/x86/kvm/x86.c |    5 +++++
 1 files changed, 5 insertions(+), 0 deletions(-)

diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
index ee005a6..fb32c3d 100644
--- a/arch/x86/kvm/x86.c
+++ b/arch/x86/kvm/x86.c
@@ -191,6 +191,11 @@ static int kvm_vm_ioctl_assign_irq(struct kvm *kvm,
 		  kvm_assigned_dev_interrupt_work_handler);
 
 	if (irqchip_in_kernel(kvm)) {
+		if (!capable(CAP_SYS_RAWIO)) {
+			return -EPERM;
+			goto out;
+		}
+
 		if (assigned_irq->host_irq)
 			match->host_irq = assigned_irq->host_irq;
 		else
-- 
1.5.6.5

Re: [PATCH] KVM: Device assignment: Check for privileges before assigning irq

[Avi Kivity]

Amit Shah wrote:
> Even though we don't share irqs at the moment, we should ensure
> regular user processes don't try to allocate system resources.
>
> We check for capability to access IO devices (CAP_SYS_RAWIO) before
> we request_irq on behalf of the guest.
>   

Applied, thanks.

-- 
error compiling committee.c: too many arguments to function