On 11/4/20 6:34 AM, Miguel Duarte de Mora Barroso wrote:
Hello, I'm having some doubts about consuming an existing - already configured - tap device from libvirt (with `managed='no' ` attribute set). In KubeVirt, we want to have the consumer side of the tap device run without the NET_ADMIN capability, which requires the UID / GID of the tap creator / opener to match, as per the kernel code in [0]. As such, we create the tap device (with the qemu user / group on behalf of qemu), which will ultimately be the tap consumer. This leads me to question: why is libvirt opening / calling `ioctl(..., TUNSETIFF, ...) ` on the tap device when it already exists - [1] & [2] ? Why can't the tap device (already configured) be left alone, and let qemu consume it ? The above is problematic for KubeVirt, since our setup currently has libvirt running as root (while qemu runs as a different user), which is preventing us from removing NET_ADMIN (libvirt & qemu run as different users).
Miguel also brought this question up in the #virt channel on irc.oftc.net, and we discussed it a bit there.
I wondered if possibly the uid of the qemu process was irrelevant, since it is libvirtd that's opening and configuring the device (and in his case libvirtd is running as root, just without the NET_ADMIN capability) - as Miguel points out in his references, the kernel allows a process running under the same uid as the owner of net device to perform ioctls on that device, even if that process doesn't have NET_ADMIN.
Miguel tried setting (actually "leaving" :-)) ownership of the tap device to root when it was created; libvirtd was then able to open and configure the device; it passed the open file descriptor to qemu (running as user qemu), which consumed and used it without problem.
So, the answer is that the pre-created / unmanaged tap/macvtap devices must be owned by the same uid as the libvirtd process, *not* the same uid as the qemu process, because libvirtd is the process that operates on the device itself (qemu just sends and receives on an already-opened file descriptor).
Thanks in advance for your time, Miguel [0] - https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/tree/drivers/net/tun.c?id=4ef8451b332662d004df269d4cdeb7d9f31419b5#n574 [1] - https://github.com/libvirt/libvirt/blob/99a1cfc43889c6d425a64013a12b234dde8cff1e/src/qemu/qemu_interface.c#L453 [2] - https://github.com/libvirt/libvirt/blob/v6.0.0/src/util/virnetdevtap.c#L274
