Re: [libvirt] CAP_SYS_RAWIO missing for qemu-kvm device passthrough
Hi Chris,
> I traced the issue down to a missing CAP_SYS_RAWIO.The kvm
kernel module
> requires CAP_SYS_RAWIO to use the KVM_ASSIGN_DEV_IRQ ioctl.
There is some pending work in KVM to deal with this. It simply removes
CAP_SYS_RAWIO. Need to finish auditing this.
Thanks for confirming the issue.
Dropping all but
CAP_SYS_RAWIO in libvirt isn't a good final solution since it
drastically undermines the value of dropping privileges.
Wouldn't it make sense to do just that as a temporary solution until the real
fix is finished?
Without a fix for this issue, Fedora 13 will, when released, not be able to do
pci device passthrough or SR-IOV. This is a regression from F12, where SR-IOV
was one of the key features (like device passthrough was in F11).
Kind regards,
Gerd