* Greg KH (greg@xxxxxxxxx) wrote: > On Thu, May 13, 2010 at 10:43:07AM -0700, Chris Wright wrote: > > * Alan Cox (alan@xxxxxxxxxxxxxxxxxxx) wrote: > > > I agree with the problem - but IMHO the fix is to require opening the file > > > checks CAP_SYS_something instead: not to hack the read method and make it > > > even weirder and more un-Linux than it is now. > > > > This patch does that. Not as convenient from the KVM/libvirt point of view > > because it is not prepared to do this setup before dropping privileges > > and launching the VM. > > So does that mean that this patch doesn't solve your original problem > here? Right, it means we have to change how we create a guest with a directly assigned PCI device. Currently KVM/libvirt is assuming that sysfs file ownership is sufficient to read a sysfs file. It chowns all relevant sysfs files and updates security labels such that only that guest can access the files, then drops privileges and launches the guest. With the v2 patch we'll have to open the config space sysfs file in the privileged context and pass it into the unprivileged one. It is awkward, but it should be doable. thanks, -chris -- To unsubscribe from this list: send the line "unsubscribe kvm" in the body of a message to majordomo@xxxxxxxxxxxxxxx More majordomo info at http://vger.kernel.org/majordomo-info.html
