[libvirt] CAP_SYS_RAWIO missing for qemu-kvm device passthrough

[Chris Wright]

* Gerd v. Egidy (lists at egidy.de) wrote:
> Hi,
> 
> I'm running current git libvirt on Fedora 13 beta. I enabled the use of 
> libcap-ng as it is done in the regular F13 .spec.
> 
> When I now pass a pci card through to a qemu-kvm guest using vt-d I get this 
> error from qemu-kvm:
> 
> Failed to assign irq for "hostdev0": Operation not permitted
> Perhaps you are assigning a device that shares an IRQ with another device?
> 
> I'm running qemu-kvm as root. But that doesn't seem to be enough:
> 
> I traced the issue down to a missing CAP_SYS_RAWIO.The kvm kernel module 
> requires CAP_SYS_RAWIO to use the KVM_ASSIGN_DEV_IRQ ioctl.

There is some pending work in KVM to deal with this.  It simply removes
CAP_SYS_RAWIO.  Need to finish auditing this.  Dropping all but
CAP_SYS_RAWIO in libvirt isn't a good final solution since it
drastically undermines the value of dropping privileges.

thanks,
-chris