[libvirt] CAP_SYS_RAWIO missing for qemu-kvm device passthrough

[Chris Wright]

* Gerd v. Egidy (lists at egidy.de) wrote:
> Hi Chris,
> 
> > > I traced the issue down to a missing CAP_SYS_RAWIO.The kvm kernel module
> > > requires CAP_SYS_RAWIO to use the KVM_ASSIGN_DEV_IRQ ioctl.
> > 
> > There is some pending work in KVM to deal with this.  It simply removes
> > CAP_SYS_RAWIO.  Need to finish auditing this.  
> 
> Thanks for confirming the issue.
> 
> > Dropping all but
> > CAP_SYS_RAWIO in libvirt isn't a good final solution since it
> > drastically undermines the value of dropping privileges.
> 
> Wouldn't it make sense to do just that as a temporary solution until the real 
> fix is finished?
> 
> Without a fix for this issue, Fedora 13 will, when released, not be able to do 
> pci device passthrough or SR-IOV. This is a regression from F12, where SR-IOV 
> was one of the key features (like device passthrough was in F11).

There's another issue w/ CAP_SYS_ADMIN.  At that point we may as well
not drop any privileges.  So, best is to fix the issues.

thanks,
-chris