I'd like to know if giving access to Intel version of /dev/kvm on Linux to a user that just wants to spawn VMs gives him any extra privileges. That is, are her VMs subject to process scheduling just like other processes? Does it automatically grant direct access to any devices or memory?
Add a comment
|
1 Answer
You could protect /dev/kvm with a group. Transfer /dev/kvm ownership to the group so that root privileges aren't given. This link explains how to do it, and here's the direct quote:
The cleanest way is probably to create a group, say kvm, and add the user(s) to that group. Then you will need change /dev/kvm to owned by group kvm.
On a system that runs udev, you will probably need to add the following line somewhere in your udev configuration so it will automatically give the right group to the newly created device (i-e for ubuntu add a line to /etc/udev/rules.d/40-permissions.rules).
KERNEL=="kvm", GROUP="kvm"
To answer your question there is no danger in giving them access to /dev/kvm. This post explains newer memory management provides protections from swapping out large amounts of memory.
