I'd like to know if giving access to Intel version of /dev/kvm on Linux to a user that just wants to spawn VMs gives him any extra privileges. That is, are her VMs subject to process scheduling just like other processes? Does it automatically grant direct access to any devices or memory?
You could protect /dev/kvm with a group. Transfer /dev/kvm ownership to the group so that root privileges aren't given. This link explains how to do it, and here's the direct quote:
To answer your question there is no danger in giving them access to /dev/kvm. This post explains newer memory management provides protections from swapping out large amounts of memory.