* Gerd v. Egidy (lists@egidy.de) wrote:
Hi,
I'm running current git libvirt on Fedora 13 beta. I enabled the use of libcap-ng as it is done in the regular F13 .spec.
When I now pass a pci card through to a qemu-kvm guest using vt-d I get this error from qemu-kvm:
Failed to assign irq for "hostdev0": Operation not permitted Perhaps you are assigning a device that shares an IRQ with another device?
I'm running qemu-kvm as root. But that doesn't seem to be enough:
I traced the issue down to a missing CAP_SYS_RAWIO.The kvm kernel module requires CAP_SYS_RAWIO to use the KVM_ASSIGN_DEV_IRQ ioctl.
There is some pending work in KVM to deal with this. It simply removes CAP_SYS_RAWIO. Need to finish auditing this. Dropping all but CAP_SYS_RAWIO in libvirt isn't a good final solution since it drastically undermines the value of dropping privileges. thanks, -chris