Prev: x86 pci: Add option to not assign BAR's if not already assigned
Next: [PATCH 2/3] tty: Fix unbalanced BKL handling in error path
From: Greg KH on 13 May 2010 15:10
On Thu, May 13, 2010 at 10:43:07AM -0700, Chris Wright wrote:
> * Alan Cox (alan(a)lxorguk.ukuu.org.uk) wrote:
> > I agree with the problem - but IMHO the fix is to require opening the file
> > checks CAP_SYS_something instead: not to hack the read method and make it
> > even weirder and more un-Linux than it is now.
>
> This patch does that. Not as convenient from the KVM/libvirt point of view
> because it is not prepared to do this setup before dropping privileges
> and launching the VM.

So does that mean that this patch doesn't solve your original problem
here?

thanks,

greg k-h
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
From: Chris Wright on 13 May 2010 15:20
* Greg KH (greg(a)kroah.com) wrote:
> On Thu, May 13, 2010 at 10:43:07AM -0700, Chris Wright wrote:
> > * Alan Cox (alan(a)lxorguk.ukuu.org.uk) wrote:
> > > I agree with the problem - but IMHO the fix is to require opening the file
> > > checks CAP_SYS_something instead: not to hack the read method and make it
> > > even weirder and more un-Linux than it is now.
> >
> > This patch does that. Not as convenient from the KVM/libvirt point of view
> > because it is not prepared to do this setup before dropping privileges
> > and launching the VM.
>
> So does that mean that this patch doesn't solve your original problem
> here?

Right, it means we have to change how we create a guest with a directly
assigned PCI device.

Currently KVM/libvirt is assuming that sysfs file ownership is sufficient
to read a sysfs file. It chowns all relevant sysfs files and updates
security labels such that only that guest can access the files, then
drops privileges and launches the guest.

With the v2 patch we'll have to open the config space sysfs file in the
privileged context and pass it into the unprivileged one. It is awkward,
but it should be doable.

thanks,
-chris
--
To unsubscribe from this list: send the line "unsubscribe linux-kernel" in
the body of a message to majordomo(a)vger.kernel.org
More majordomo info at http://vger.kernel.org/majordomo-info.html
Please read the FAQ at http://www.tux.org/lkml/
 | 
Pages: 1
Prev: x86 pci: Add option to not assign BAR's if not already assigned
Next: [PATCH 2/3] tty: Fix unbalanced BKL handling in error path