Re: [PATCH] kvm: remove CAP_SYS_RAWIO requirement fromkvm_vm_ioctl_assign_irq

[Chris Wright]

* Alex Williamson (alex.williamson@xxxxxxxxxx) wrote:
> Remove this check in an effort to allow kvm guests to run without
> root privileges.  This capability check doesn't seem to add any
> security since the device needs to have already been added via the
> assign device ioctl and the io actually occurs through the pci
> sysfs interface.

Right, so irq resource allocation can't be directly abused (by calling
this ioctl out of order, for example) because the device must be assigned
first via kvm_vm_ioctl_assign_device().  My only concern isn't with this
patch per-se, but the exising kvm_vm_ioctl_assign_device().

thanks,
-chris
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html
Please read the FAQ at  http://www.tux.org/lkml/