From c4446798fa45b29fe29f7eb9502c1f006df5bc0e Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 13 Jan 2021 12:56:26 +0400 Subject: [PATCH 1/3] udev: make /dev/vsock 0666 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /dev/vsock supports only ioctl (the only ioctl supported is IOCTL_VM_SOCKETS_GET_LOCAL_CID), so 0666 should be okay, or 0664 if in the future we will implement some kind of write support exposed only to user/group. Signed-off-by: Marc-André Lureau --- rules.d/50-udev-default.rules.in | 2 ++ 1 file changed, 2 insertions(+) diff --git a/rules.d/50-udev-default.rules.in b/rules.d/50-udev-default.rules.in index e1146fa88f..6688b840d6 100644 --- a/rules.d/50-udev-default.rules.in +++ b/rules.d/50-udev-default.rules.in @@ -85,6 +85,8 @@ KERNEL=="fuse", MODE="0666", OPTIONS+="static_node=fuse" # The static_node is required on s390x and ppc (they are using MODULE_ALIAS) KERNEL=="kvm", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=kvm" +KERNEL=="vsock", MODE="0666" + KERNEL=="udmabuf", GROUP="kvm" SUBSYSTEM=="ptp", ATTR{clock_name}=="KVM virtual PTP", SYMLINK += "ptp_kvm" From c78939d5652aaee2731956282c1c17aa9f7f710f Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Tue, 12 Jan 2021 16:03:37 +0400 Subject: [PATCH 2/3] udev: allow kvm group to access vhost-vsock device MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /dev/vhost-vsock allows to setup a guest CID and running state (VHOST_VSOCK_SET_GUEST_CID, VHOST_VSOCK_SET_RUNNING) All this should be legitimate and safe for KVM users. Signed-off-by: Marc-André Lureau --- rules.d/50-udev-default.rules.in | 1 + tmpfiles.d/static-nodes-permissions.conf.in | 1 + 2 files changed, 2 insertions(+) diff --git a/rules.d/50-udev-default.rules.in b/rules.d/50-udev-default.rules.in index 6688b840d6..0cc70b1bd0 100644 --- a/rules.d/50-udev-default.rules.in +++ b/rules.d/50-udev-default.rules.in @@ -86,6 +86,7 @@ KERNEL=="fuse", MODE="0666", OPTIONS+="static_node=fuse" KERNEL=="kvm", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=kvm" KERNEL=="vsock", MODE="0666" +KERNEL=="vhost-vsock", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=vhost-vsock" KERNEL=="udmabuf", GROUP="kvm" diff --git a/tmpfiles.d/static-nodes-permissions.conf.in b/tmpfiles.d/static-nodes-permissions.conf.in index 50cffe2cd9..923ce7d93e 100644 --- a/tmpfiles.d/static-nodes-permissions.conf.in +++ b/tmpfiles.d/static-nodes-permissions.conf.in @@ -15,3 +15,4 @@ z /dev/loop-control 0660 - disk - z /dev/net/tun 0666 - - - z /dev/fuse 0666 - - - z /dev/kvm @DEV_KVM_MODE@ - kvm - +z /dev/vhost-vsock @DEV_KVM_MODE@ - kvm - From f65efddd1c4ede9445a2948a88d6d235cf1e8c7d Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= Date: Wed, 13 Jan 2021 13:12:26 +0400 Subject: [PATCH 3/3] udev: allow kvm group to access vhost-net device MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit /dev/vhost-net is a host accelerator for virtio net devices. It has been long available and used, thus should be safe to all KVM users. Signed-off-by: Marc-André Lureau --- rules.d/50-udev-default.rules.in | 2 ++ tmpfiles.d/static-nodes-permissions.conf.in | 1 + 2 files changed, 3 insertions(+) diff --git a/rules.d/50-udev-default.rules.in b/rules.d/50-udev-default.rules.in index 0cc70b1bd0..369fdbc179 100644 --- a/rules.d/50-udev-default.rules.in +++ b/rules.d/50-udev-default.rules.in @@ -88,6 +88,8 @@ KERNEL=="kvm", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=kvm" KERNEL=="vsock", MODE="0666" KERNEL=="vhost-vsock", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=vhost-vsock" +KERNEL=="vhost-net", GROUP="kvm", MODE="@DEV_KVM_MODE@", OPTIONS+="static_node=vhost-net" + KERNEL=="udmabuf", GROUP="kvm" SUBSYSTEM=="ptp", ATTR{clock_name}=="KVM virtual PTP", SYMLINK += "ptp_kvm" diff --git a/tmpfiles.d/static-nodes-permissions.conf.in b/tmpfiles.d/static-nodes-permissions.conf.in index 923ce7d93e..e5aa8fdb20 100644 --- a/tmpfiles.d/static-nodes-permissions.conf.in +++ b/tmpfiles.d/static-nodes-permissions.conf.in @@ -15,4 +15,5 @@ z /dev/loop-control 0660 - disk - z /dev/net/tun 0666 - - - z /dev/fuse 0666 - - - z /dev/kvm @DEV_KVM_MODE@ - kvm - +z /dev/vhost-net @DEV_KVM_MODE@ - kvm - z /dev/vhost-vsock @DEV_KVM_MODE@ - kvm -