Commit 6762b729 authored Aug 13, 2008 by Amit Shah Committed by Avi Kivity Oct 15, 2008

KVM: Device assignment: Check for privileges before assigning irq



Even though we don't share irqs at the moment, we should ensure
regular user processes don't try to allocate system resources.

We check for capability to access IO devices (CAP_SYS_RAWIO) before
we request_irq on behalf of the guest.

Noticed by Avi.

Signed-off-by: Amit Shah <amit.shah@qumranet.com>
Signed-off-by: Avi Kivity <avi@qumranet.com>

parent dc7404ce

arch/x86/kvm/x86.c

+5 −0

Original line number	Diff line number	Diff line
		@@ -191,6 +191,11 @@ static int kvm_vm_ioctl_assign_irq(struct kvm *kvm,
		kvm_assigned_dev_interrupt_work_handler);

		if (irqchip_in_kernel(kvm)) {
		if (!capable(CAP_SYS_RAWIO)) {
		return -EPERM;
		goto out;
		}

		if (assigned_irq->host_irq)
		match->host_irq = assigned_irq->host_irq;
		else