* Gerd v. Egidy (lists@xxxxxxxx) wrote: > Hi Chris, > > > > I traced the issue down to a missing CAP_SYS_RAWIO.The kvm kernel module > > > requires CAP_SYS_RAWIO to use the KVM_ASSIGN_DEV_IRQ ioctl. > > > > There is some pending work in KVM to deal with this. It simply removes > > CAP_SYS_RAWIO. Need to finish auditing this. > > Thanks for confirming the issue. > > > Dropping all but > > CAP_SYS_RAWIO in libvirt isn't a good final solution since it > > drastically undermines the value of dropping privileges. > > Wouldn't it make sense to do just that as a temporary solution until the real > fix is finished? > > Without a fix for this issue, Fedora 13 will, when released, not be able to do > pci device passthrough or SR-IOV. This is a regression from F12, where SR-IOV > was one of the key features (like device passthrough was in F11). There's another issue w/ CAP_SYS_ADMIN. At that point we may as well not drop any privileges. So, best is to fix the issues. thanks, -chris -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list