I'm completely confused about access to /dev/kvm. In particular, it
looks like it is too open to access, but in a way that I don't
understand.
On my machine, /dev/kvm is owned by root.root and mode 660. Here is the
output of ls:
% ls -l /dev/kvm
crw-rw----+ 1 root root 10, 232 Aug 24 15:03 /dev/kvm
Despite that, when a process is uid 1000 and group id 1000, and not in
any other groups, I can open /dev/kvm.
I.e., here are the relevant lines from /proc/<pid>/status:
Uid: 1000 1000 1000 1000
Gid: 1000 1000 1000 1000
Groups: 1000
Note, just to show this isn't some weirdness in /etc/passwd or
/etc/groups, here is the output of stat on /dev/kvm:
File: `/dev/kvm'
Size: 0 Blocks: 0 IO Block: 4096
character special file
Device: 5h/5d Inode: 2597329 Links: 1 Device type: a,e8
Access: (0660/crw-rw----) Uid: ( 0/ root) Gid: ( 0/ root)
Access: 2012-08-24 15:03:33.616998585 -0500
Modify: 2012-08-24 15:03:33.616998585 -0500
Change: 2012-08-24 15:03:33.616998585 -0500
Please note, I don't understand how this could really be. Regardless of
what the /dev/kvm driver does, I don't get how I can get to open it if
the file which `is' the device doesn't have the correct permissions.
The driver can make access more restrictive than the file permissions,
but not less restrictive, or so I thought.
Also, if I try opening /dev/kvm as uid 1001 and group id 1000, again not
in any other groups, it fails.
I don't understand how this could be. Also, it means that uid 1000/gid
1000 can run virtual processes. I want to be able to limit that, and I
would have thought that /dev/kvm having mode 660 and being owned by
root.root would have done it.
If it is any help, I am running a stock Debian Squeeze. The kernel is
2.6.32-5-amd64.
Any help or pointers explaining how /dev/kvm can be opened by uid
1000/gid 1000 would be greatly appreciated. Also any explanation about
why uid 1000 is different than 1001.
Thanks
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to [email protected]
More majordomo info at http://vger.kernel.org/majordomo-info.html
