lkml.org 
[lkml]   [2011]   [Dec]   [23]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
/
Date
From
SubjectRe: [PATCH v3 0/2] kvm: Lock down device assignment
On Tue, Dec 20, 2011 at 09:58:57PM -0700, Alex Williamson wrote:
> v2: Update API documentation for each patch
> v3: Incorporate Sasha's comments: kobject path, separate func, and CONFIG_SYSFS
>
> Two patches to try to better secure the device assignment ioctl.
> This firt patch makes KVM_DEV_ASSIGN_ENABLE_IOMMU a mandatory
> option when assigning a device. I don't believe we have any
> users of this option, so I think we can skip any deprecation
> period, especially since it's existence is rather dangerous.
>
> The second patch introduces some file permission checking that Avi
> suggested. If a user has been granted read/write permission to
> the PCI sysfs BAR resource files, this is a good indication that
> they have access to the device. We can't call sys_faccessat
> directly (not exported), but the important bits are self contained
> enough to include directly. This still works with sudo and libvirt
> usage, the latter already grants qemu permission to these files.
> Thanks,
>
> Alex
>
> ---
>
> Alex Williamson (2):
> kvm: Device assignment permission checks
> kvm: Remove ability to assign a device without iommu support

Applied, thanks.



\
 
 \ /
  Last update: 2011-12-23 12:41    [W:0.075 / U:0.720 seconds]
©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site