Messages in this thread | | | Date | Tue, 20 Dec 2011 11:23:06 +0200 | From | Avi Kivity <> | Subject | Re: [PATCH 0/2] kvm: Lock down device assignment |
| |
On 12/20/2011 05:19 AM, Alex Williamson wrote: > Two patches to try to better secure the device assignment ioctl. > This firt patch makes KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory > option when assigning a device. I don't believe we have any > users of this option, so I think we can skip any deprecation > period, especially since it's existence is rather dangerous. > > The second patch introduces some file permission checking that Avi > suggested. If a user has been granted read/write permission to > the PCI sysfs BAR resource files, this is a good indication that > they have access to the device. We can't call sys_faccessat > directly (not exported), but the important bits are self contained > enough to include directly. This still works with sudo and libvirt > usage, the latter already grants qemu permission to these files. > Thanks, > >
Looks good, but please update the API documentation.
-- error compiling committee.c: too many arguments to function
| |