Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I'd like to know if giving access to Intel version of /dev/kvm on Linux to a user that just wants to spawn VMs gives him any extra privileges. That is, are her VMs subject to process scheduling just like other processes? Does it automatically grant direct access to any devices or memory?

share|improve this question

1 Answer 1

up vote 1 down vote accepted

You could protect /dev/kvm with a group. Transfer /dev/kvm ownership to the group so that root privileges aren't given. This link explains how to do it, and here's the direct quote:

The cleanest way is probably to create a group, say kvm, and add the user(s) to that group. Then you will need change /dev/kvm to owned by group kvm.

On a system that runs udev, you will probably need to add the following line somewhere in your udev configuration so it will automatically give the right group to the newly created device (i-e for ubuntu add a line to /etc/udev/rules.d/40-permissions.rules).

KERNEL=="kvm", GROUP="kvm"

To answer your question there is no danger in giving them access to /dev/kvm. This post explains newer memory management provides protections from swapping out large amounts of memory.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.