On Tue, 2017-12-05 at 16:55 +0000, Dave Boutcher wrote:
> There was some discussion back in 2016 about running SPDK (and DPDK)
> applications as non-root users.  I finally got annoyed enough about this to
> figure it out.
> 
> You can run SPDK applications as non-root if you set the following
> capabilities:
> 
>  $ sudo setcap "cap_dac_read_search,cap_sys_admin+ep" myapplication
> 
> Note that this is a fairly big hammer...by the time you give the application
> sys_admin and dac_read_search, it is fairly powerful, but it is a smaller
> hammer than running as root :-)

Fortunately, it is totally possible to run SPDK and DPDK without granting your
user any additional permissions (except for one catch). If you just run the SPDK
scripts/setup.sh under sudo, it automatically sets up whatever user invoked the
sudo command to be able to run as an entirely unprivileged user. The only
requirement is that you have VT-d and your IOMMU enabled. You'll know you have
it right if you see scripts/setup.sh binding your devices to vfio-pci instead of
uio.

The catch is that we accidentally broke this a few months ago on some
distributions because they don't allow unprivileged users to call shm_open with
the O_CREAT flag. To make it work again, you need to grant your user permission
to write to /dev/shm. I just tried it and it works, at least on Fedora 26. We'll
try to come up with a better strategy here.

> _______________________________________________
> SPDK mailing list
> SPDK(a)lists.01.org
> https://lists.01.org/mailman/listinfo/spdk