lkml.org 
[lkml]   [2008]   [Sep]   [25]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    Patch in this message
    /
    From
    Subject[PATCH 08/39] KVM: Device assignment: Check for privileges before assigning irq
    Date
    From: Amit Shah <amit.shah@qumranet.com>

    Even though we don't share irqs at the moment, we should ensure
    regular user processes don't try to allocate system resources.

    We check for capability to access IO devices (CAP_SYS_RAWIO) before
    we request_irq on behalf of the guest.

    Noticed by Avi.

    Signed-off-by: Amit Shah <amit.shah@qumranet.com>
    Signed-off-by: Avi Kivity <avi@qumranet.com>
    ---
    arch/x86/kvm/x86.c | 5 +++++
    1 files changed, 5 insertions(+), 0 deletions(-)

    diff --git a/arch/x86/kvm/x86.c b/arch/x86/kvm/x86.c
    index 4a03375..fffdf4f 100644
    --- a/arch/x86/kvm/x86.c
    +++ b/arch/x86/kvm/x86.c
    @@ -191,6 +191,11 @@ static int kvm_vm_ioctl_assign_irq(struct kvm *kvm,
    kvm_assigned_dev_interrupt_work_handler);

    if (irqchip_in_kernel(kvm)) {
    + if (!capable(CAP_SYS_RAWIO)) {
    + return -EPERM;
    + goto out;
    + }
    +
    if (assigned_irq->host_irq)
    match->host_irq = assigned_irq->host_irq;
    else
    --
    1.6.0.1


    \
     
     \ /
      Last update: 2008-09-25 14:01    [W:0.021 / U:90.448 seconds]
    ©2003-2016 Jasper Spaans. hosted at Digital OceanAdvertise on this site