Re: [PATCH RFC v2 00/13] IOMMUFD Generic interface

From: "Daniel P. Berrangé" <berrange@redhat.com>
To: Jason Gunthorpe <jgg@nvidia.com>
Cc: Alex Williamson <alex.williamson@redhat.com>,
	Eric Auger <eric.auger@redhat.com>,
	"Tian, Kevin" <kevin.tian@intel.com>,
	"Rodel, Jorg" <jroedel@suse.de>,
	Lu Baolu <baolu.lu@linux.intel.com>,
	Chaitanya Kulkarni <chaitanyak@nvidia.com>,
	Cornelia Huck <cohuck@redhat.com>,
	Daniel Jordan <daniel.m.jordan@oracle.com>,
	David Gibson <david@gibson.dropbear.id.au>,
	Eric Farman <farman@linux.ibm.com>,
	"iommu@lists.linux.dev" <iommu@lists.linux.dev>,
	Jason Wang <jasowang@redhat.com>,
	Jean-Philippe Brucker <jean-philippe@linaro.org>,
	"Martins, Joao" <joao.m.martins@oracle.com>,
	"kvm@vger.kernel.org" <kvm@vger.kernel.org>,
	Matthew Rosato <mjrosato@linux.ibm.com>,
	"Michael S. Tsirkin" <mst@redhat.com>,
	Nicolin Chen <nicolinc@nvidia.com>,
	Niklas Schnelle <schnelle@linux.ibm.com>,
	Shameerali Kolothum Thodi  <shameerali.kolothum.thodi@huawei.com>,
	"Liu, Yi L" <yi.l.liu@intel.com>,
	Keqian Zhu <zhukeqian1@huawei.com>,
	Steve Sistare <steven.sistare@oracle.com>,
	"libvir-list@redhat.com" <libvir-list@redhat.com>,
	Laine Stump <laine@redhat.com>
Subject: Re: [PATCH RFC v2 00/13] IOMMUFD Generic interface
Date: Fri, 23 Sep 2022 15:00:55 +0100	[thread overview]
Message-ID: <Yy28FzEnoKo8UExU@redhat.com> (raw)
In-Reply-To: <Yy24rX8NQkxR2KCV@nvidia.com>

On Fri, Sep 23, 2022 at 10:46:21AM -0300, Jason Gunthorpe wrote:
> On Fri, Sep 23, 2022 at 02:35:20PM +0100, Daniel P. Berrangé wrote:
> > On Fri, Sep 23, 2022 at 10:29:41AM -0300, Jason Gunthorpe wrote:
> > > On Fri, Sep 23, 2022 at 09:54:48AM +0100, Daniel P. Berrangé wrote:
> > > 
> > > > Yes, we use cgroups extensively already.
> > > 
> > > Ok, I will try to see about this
> > > 
> > > Can you also tell me if the selinux/seccomp will prevent qemu from
> > > opening more than one /dev/vfio/vfio ? I suppose the answer is no?
> > 
> > I don't believe there's any restriction on the nubmer of open attempts,
> > its just a case of allowed or denied globally for the VM.
> 
> Ok
> 
> For iommufd we plan to have qemu accept a single already opened FD of
> /dev/iommu and so the selinux/etc would block all access to the
> chardev.

A selinux policy update would be needed to allow read()/write() for the
inherited FD, whle keeping open() blocked

> Can you tell me if the thing invoking qmeu that will open /dev/iommu
> will have CAP_SYS_RESOURCE ? I assume yes if it is already touching
> ulimits..

The privileged libvirtd runs with privs equiv to root, so all
capabilities are present.

The unprivileged libvirtd runs with same privs as your user account,
so no capabilities. I vaguely recall there was some way to enable
use of PCI passthrough for unpriv libvirtd, but needed a bunch of
admin setup steps ahead of time.

With regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|