On Mon, Feb 4, 2019 at 9:59 AM Michal Privoznik <mprivozn@xxxxxxxxxx> wrote: > > On 2/1/19 7:04 PM, Daniel Henrique Barboza wrote: > > Hi, > > > > I'm facing a strange behavior when running Libvirt from source code, > > latest upstream, on an Ubuntu 18.04.1 LTS Power 9 server. My QEMU > > guest - which is using VFIO and GPU passthrough - breaks on boot when > > trying to allocate a DMA window inside KVM. > > > > Debugging the code, I've found out that the problem is related to the > > process > > not having CAP_IPC_LOCK - at least from the host kernel perspective. > > > > This is strange because: > > > > - the same VM running directly from QEMU command line works > > - the same VM running in the system Libvirt (v4.0.0, Ubuntu version) > > also works FYI Ubuntu's version is build with capng for the cap dropping feature as discussed in this thread. libcap-ng-dev is installed as build dependencies and "--with-capng" is set on all Linux builds. > > > > What am I missing? My understanding on Linux process is that a process > > running as root should inherit the same capabilities of the user, which > > includes > > CAP_IPC_LOCK. Running Libvirt from source code should grant ipc_lock > > to it ... right? > > No. Ideally, you trust libvirt and want it to manage devices on your > system thus it needs all the capabilities. But qemu spawn by libvirt > should have no capabilities as libvirt set up everything that's needed > for qemu to run. But this is hard to get right - qemu changes and so > does the capabilities it may require (these depend on domain > configuration anyway). Therefore, it is possible to set libvirt so it > does not drop capabilities for qemu process - see > clear_emulator_capabilities in qemu.conf - but then libvirt can't > guarantee that a compromised qemu does no harm. > > This corresponds with your finding about ./configure - if there is no > libncap-ng found there's no way for libvirt to drop capabilities and > thus it doesn't do that. > > Michal > > -- > libvir-list mailing list > libvir-list@xxxxxxxxxx > https://www.redhat.com/mailman/listinfo/libvir-list -- Christian Ehrhardt Software Engineer, Ubuntu Server Canonical Ltd
