From nobody Tue Oct 28 08:17:00 2025 Delivered-To: importer@patchew.org Received-SPF: pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) client-ip=8.43.85.245; envelope-from=devel-bounces@lists.libvirt.org; helo=lists.libvirt.org; Authentication-Results: mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass(p=none dis=none) header.from=gmail.com ARC-Seal: i=1; a=rsa-sha256; t=1761148907; cv=none; d=zohomail.com; s=zohoarc; b=iYgzz3/StsV1Bq6P5JZk6xfOtFJXagZQ+lBhpAYekF89m7Z+z19nEyk4KOeh2HoVWV9zLaYHZIoPm0IXDS3UTfeof7bQQIDydTDdKHAkFx2bU2+mshrm/7GPVU/Babz8tmKn6r0XdL8YKqgkc6z//sF39jQb2pCJeURNnevxrYo= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1761148907; h=Content-Transfer-Encoding:Cc:Cc:Date:Date:From:From:List-Subscribe:List-Post:List-Owner:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:Subject:Subject:To:To:Message-Id:Reply-To; bh=d0uEMLiFyEgBdll6mA7ow4XHwmlmpcZuA/gA7ynZNYY=; b=Hg2QZv8pNY2uzXL4rfjKeVjcHkvFSlm0BFLMAvXTlcwO9ZFJfc5cK3pskS1TJFcuFYuPM2NVPp7fv9xS28m6ANUrxxyzpbaxU3IZkmKKP5ptbF+ntnPdIHty1wXGmcLez9hYJgUr/nq5giiHOECVTm4VJNJ2n/DLhFacKegzo3s= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=pass; spf=pass (zohomail.com: domain of lists.libvirt.org designates 8.43.85.245 as permitted sender) smtp.mailfrom=devel-bounces@lists.libvirt.org; dmarc=pass header.from= (p=none dis=none) Return-Path: Received: from lists.libvirt.org (lists.libvirt.org [8.43.85.245]) by mx.zohomail.com with SMTPS id 1761148907198489.3903739384166; Wed, 22 Oct 2025 09:01:47 -0700 (PDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 94A0B41902; Wed, 22 Oct 2025 12:01:45 -0400 (EDT) Received: from [172.19.199.20] (lists.libvirt.org [8.43.85.245]) by lists.libvirt.org (Postfix) with ESMTP id 18F2941BC5; Wed, 22 Oct 2025 12:00:23 -0400 (EDT) Received: by lists.libvirt.org (Postfix, from userid 993) id 946494189C; Wed, 22 Oct 2025 11:54:47 -0400 (EDT) Received: from mail-ot1-f46.google.com (mail-ot1-f46.google.com [209.85.210.46]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (3072 bits) server-digest SHA256) (No client certificate requested) by lists.libvirt.org (Postfix) with ESMTPS id 09D054189A for ; Wed, 22 Oct 2025 11:54:45 -0400 (EDT) Received: by mail-ot1-f46.google.com with SMTP id 46e09a7af769-7c0e8367d4eso2412168a34.1 for ; Wed, 22 Oct 2025 08:54:45 -0700 (PDT) Received: from home ([2603:8081:c640:1::1003]) by smtp.gmail.com with ESMTPSA id 46e09a7af769-7c2889105edsm4694777a34.26.2025.10.22.08.54.43 (version=TLS1_3 cipher=TLS_AES_256_GCM_SHA384 bits=256/256); Wed, 22 Oct 2025 08:54:44 -0700 (PDT) X-Spam-Checker-Version: SpamAssassin 4.0.1 (2024-03-26) on lists.libvirt.org X-Spam-Level: X-Spam-Status: No, score=-3.4 required=5.0 tests=DKIM_SIGNED,DKIM_VALID, DKIM_VALID_AU,FREEMAIL_FORGED_FROMDOMAIN,FREEMAIL_FROM, HEADER_FROM_DIFFERENT_DOMAINS,MAILING_LIST_MULTI,RCVD_IN_DNSWL_MED, RCVD_IN_VALIDITY_CERTIFIED_BLOCKED,RCVD_IN_VALIDITY_RPBL_BLOCKED, RCVD_IN_VALIDITY_SAFE_BLOCKED,SPF_PASS autolearn=unavailable autolearn_force=no version=4.0.1 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1761148485; x=1761753285; darn=lists.libvirt.org; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:from:to:cc:subject:date:message-id:reply-to; bh=d0uEMLiFyEgBdll6mA7ow4XHwmlmpcZuA/gA7ynZNYY=; b=JSmByVF9yrJR3mDgULZh3OqLHUSkutz9Ch1qRJmYEWHzc+8gSLGp+PR+pvsJDF5yfe PYcHHPEOTGWzifFO4VYCAPUCI7aeMoz0u/DSX9rced7wjnj5LPODGJfdOvs3Gr1zp72e 4CEbVO/DTbuhe1HFlvIiUKHdHv7AdHgoTs0BzVvRzpsfYIZho0nT5bb8RO43u5j95b4B +RrnRwHepHWFuCAlPL5hpFmBSm3osrk/08aUHv6JSyqvEyjNAWyJhJVDxMUgZO7bmjg5 Qsv/36aq/DEY7MADL096/se3Bv/5VRqLpq8AL516gPDeI4wkIePONkndr3hszmpk0SCW I2nw== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1761148485; x=1761753285; h=content-transfer-encoding:mime-version:message-id:date:subject:cc :to:from:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=d0uEMLiFyEgBdll6mA7ow4XHwmlmpcZuA/gA7ynZNYY=; b=JE7dLCLJmtAqUkjwt5sf48YMki2AaqUoN7cPfEIcHJQNR/wX0nanD7fVMRxXsHPlbm qkpCf9x4j3HUa3Lgb4lM4xu3jI4lONXdJlS9ih4txkdo87MTHsrzHIKP/X8Mw9GTvoPk lbhy8b7087indWxmpOhhEbYxzvD3GvedwZMLWF6Ne9FJWLXICAMuDw0pDL5Ra4RFNi9Y ok5oSrL7KdPebKtPvdbNK1iUV0GPhPZ8qBaPvlGE0knzdZiUyXNVUQXdBWdZMuiMuNEp hYa/thefJ+/5KMp/luBHtNWo6OpysHYtVT3z/Mn7Q1t7jUkLiEdU+sz67DZBEPoXzg+N FxeQ== X-Gm-Message-State: AOJu0Yxzf1OGLLjYZbLMHlZrahAAPn3E2aWSxgNy3DN+plJnikn3pwWs //K5us4GrTwr74nHa9F4nFFDaBjH+x1WHO+jzOwo6J9qa/pHWbalqhSF2EDH2B1e X-Gm-Gg: ASbGncsIHRdXjK5L8xdiP9LQj8Jddx6TJjyOWx7RqNnIki4+V2gkfETD/A8rxZi5wHb w7eOz4fReMM7Rj9/JZdn8f1TFiVnpA8V1oF1/ECK7PsEcrrQ2IyyMhx4clVUzgyQKQ6TKodOM+K xjG/6nZ9/ZFamGOQGrWppdVWfdqEBKnXMAXd/bBXpI/U9n3Rt3KX4PZhPiLjuQqE6d5DiSATjDd FSls/CUuAZdKEqYYTjbLb5FIZw/FDw7DyGxBPf2o0aPJ0qLnI+vHsm997oKd2asZ5+vQoobIv44 rxYZOZ5lipGPw3IZIPJpG/qpuJeXVMDdwLult8WaIRmJCnZX9ecGrhwW7GphbJBS81iILNYP1wv xvCxKjuLdW9ANPHe5vpJ57jpe6sqNCx97tXVEgsJXU19wHhLWKKVT5jjZJoWyIBSAWp7o X-Google-Smtp-Source: AGHT+IGvaxd+ZkUgFVsidkdeIGyoSgptRfEK+EYI48VjNKQOsH6+I9NoPiC316CG7dD10ZpOhJ7SLA== X-Received: by 2002:a05:6830:6adc:b0:7ac:f4c0:7283 with SMTP id 46e09a7af769-7c27cbdbc09mr9220782a34.27.1761148484746; Wed, 22 Oct 2025 08:54:44 -0700 (PDT) From: Praveen K Paladugu To: devel@lists.libvirt.org Subject: [PATCH v3] qemu: Drop /dev/kvm from default device ACL Date: Wed, 22 Oct 2025 10:54:37 -0500 Message-ID: <20251022155437.13813-1-praveenkpaladugu@gmail.com> X-Mailer: git-send-email 2.51.0 MIME-Version: 1.0 Content-Transfer-Encoding: quoted-printable Message-ID-Hash: RNYWXBTWMPG3LFYZCPCKHPF7WECVWAFZ X-Message-ID-Hash: RNYWXBTWMPG3LFYZCPCKHPF7WECVWAFZ X-MailFrom: praveenkpaladugu@gmail.com X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; header-match-devel.lists.libvirt.org-0; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header CC: wei.liu@kernel.org, liuwe@microsoft.com X-Mailman-Version: 3.3.10 Precedence: list List-Id: Development discussions about the libvirt library & tools Archived-At: List-Archive: List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: X-ZohoMail-DKIM: pass (identity @gmail.com) X-ZM-MESSAGEID: 1761148909970154100 Content-Type: text/plain; charset="utf-8" From: Praveen K Paladugu A domain that runs with TCG emulation does not need kvm device, so drop it from default device ACL. Dynamically grant access to /dev/kvm based on domain type. Signed-off-by: Praveen K Paladugu --- src/qemu/qemu.conf.in | 3 +-- src/qemu/qemu_cgroup.c | 10 ++++++++-- src/qemu/qemu_domain.h | 1 + src/qemu/qemu_namespace.c | 9 +++++++-- src/qemu/test_libvirtd_qemu.aug.in | 3 +-- 5 files changed, 18 insertions(+), 8 deletions(-) diff --git a/src/qemu/qemu.conf.in b/src/qemu/qemu.conf.in index fc91ba8f08..0a8abd9544 100644 --- a/src/qemu/qemu.conf.in +++ b/src/qemu/qemu.conf.in @@ -618,8 +618,7 @@ #cgroup_device_acl =3D [ # "/dev/null", "/dev/full", "/dev/zero", # "/dev/random", "/dev/urandom", -# "/dev/ptmx", "/dev/kvm", -# "/dev/userfaultfd" +# "/dev/ptmx", "/dev/userfaultfd" #] # # RDMA migration requires the following extra files to be added to the lis= t: diff --git a/src/qemu/qemu_cgroup.c b/src/qemu/qemu_cgroup.c index f10976c2b0..46a7dc1d8b 100644 --- a/src/qemu/qemu_cgroup.c +++ b/src/qemu/qemu_cgroup.c @@ -41,8 +41,7 @@ VIR_LOG_INIT("qemu.qemu_cgroup"); const char *const defaultDeviceACL[] =3D { "/dev/null", "/dev/full", "/dev/zero", "/dev/random", "/dev/urandom", - "/dev/ptmx", "/dev/kvm", - "/dev/userfaultfd", + "/dev/ptmx", "/dev/userfaultfd", NULL, }; #define DEVICE_PTY_MAJOR 136 @@ -783,6 +782,13 @@ qemuSetupDevicesCgroup(virDomainObj *vm) if (qemuCgroupAllowDevicesPaths(vm, deviceACL, VIR_CGROUP_DEVICE_RW, f= alse) < 0) return -1; =20 + if (vm->def->virtType =3D=3D VIR_DOMAIN_VIRT_KVM) { + /* KVM requires access to /dev/kvm */ + if (qemuCgroupAllowDevicePath(vm, QEMU_DEV_KVM, VIR_CGROUP_DEVICE_= RW, + false) < 0) + return -1; + } + if (qemuSetupFirmwareCgroup(vm) < 0) return -1; =20 diff --git a/src/qemu/qemu_domain.h b/src/qemu/qemu_domain.h index f4945f598a..fe4ba4fa15 100644 --- a/src/qemu/qemu_domain.h +++ b/src/qemu/qemu_domain.h @@ -89,6 +89,7 @@ struct _qemuDomainUnpluggingDevice { #define QEMU_DEV_SGX_PROVISION "/dev/sgx_provision" #define QEMU_DEVICE_MAPPER_CONTROL_PATH "/dev/mapper/control" #define QEMU_DEV_UDMABUF "/dev/udmabuf" +#define QEMU_DEV_KVM "/dev/kvm" =20 =20 #define QEMU_DOMAIN_AES_IV_LEN 16 /* 16 bytes for 128 bit random */ diff --git a/src/qemu/qemu_namespace.c b/src/qemu/qemu_namespace.c index f72da83929..ca12fcf587 100644 --- a/src/qemu/qemu_namespace.c +++ b/src/qemu/qemu_namespace.c @@ -210,13 +210,18 @@ qemuDomainGetPreservedMounts(virQEMUDriverConfig *cfg, =20 static int qemuDomainPopulateDevices(virQEMUDriverConfig *cfg, + virDomainObj *vm, GSList **paths) { const char *const *devices =3D (const char *const *) cfg->cgroupDevice= ACL; size_t i; =20 - if (!devices) + if (!devices) { devices =3D defaultDeviceACL; + if (vm->def->virtType =3D=3D VIR_DOMAIN_VIRT_KVM) { + *paths =3D g_slist_prepend(*paths, g_strdup(QEMU_DEV_KVM)); + } + } =20 for (i =3D 0; devices[i]; i++) { *paths =3D g_slist_prepend(*paths, g_strdup(devices[i])); @@ -694,7 +699,7 @@ qemuDomainBuildNamespace(virQEMUDriverConfig *cfg, return 0; } =20 - if (qemuDomainPopulateDevices(cfg, &paths) < 0) + if (qemuDomainPopulateDevices(cfg, vm, &paths) < 0) return -1; =20 if (qemuDomainSetupAllDisks(vm, &paths) < 0) diff --git a/src/qemu/test_libvirtd_qemu.aug.in b/src/qemu/test_libvirtd_qe= mu.aug.in index 90012b3f52..82cfec3b4b 100644 --- a/src/qemu/test_libvirtd_qemu.aug.in +++ b/src/qemu/test_libvirtd_qemu.aug.in @@ -76,8 +76,7 @@ module Test_libvirtd_qemu =3D { "4" =3D "/dev/random" } { "5" =3D "/dev/urandom" } { "6" =3D "/dev/ptmx" } - { "7" =3D "/dev/kvm" } - { "8" =3D "/dev/userfaultfd" } + { "7" =3D "/dev/userfaultfd" } } { "save_image_format" =3D "raw" } { "dump_image_format" =3D "raw" } --=20 2.51.0