lkml.org 
[lkml]   [2011]   [Dec]   [20]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
From
Subject[PATCH v2 0/2] kvm: Lock down device assignment
Date
v2: Update API documentation for each patch

Two patches to try to better secure the device assignment ioctl.
This firt patch makes KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory
option when assigning a device. I don't believe we have any
users of this option, so I think we can skip any deprecation
period, especially since it's existence is rather dangerous.

The second patch introduces some file permission checking that Avi
suggested. If a user has been granted read/write permission to
the PCI sysfs BAR resource files, this is a good indication that
they have access to the device. We can't call sys_faccessat
directly (not exported), but the important bits are self contained
enough to include directly. This still works with sudo and libvirt
usage, the latter already grants qemu permission to these files.
Thanks,

Alex

---

Alex Williamson (2):
kvm: Device assignment permission checks
kvm: Remove ability to assign a device without iommu support


Documentation/virtual/kvm/api.txt | 7 ++++
virt/kvm/assigned-dev.c | 73 ++++++++++++++++++++++++++++++++-----
2 files changed, 70 insertions(+), 10 deletions(-)


\
 
 \ /
  Last update: 2011-12-20 15:33    [W:0.043 / U:1.056 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site