Subject: Re: [vserver] KVM in a guest, security implications?
From: "Gregory (Grisha) Trubetskoy" <grisha@apache.org>
Date: Sat, 8 Nov 2008 16:53:06 -0500 (EST)


To follow up on my post, it seems that the Vserver scheduler has no effect 
on the KVM processes. You can have a very intensive task in a KVM (QEMU 
running in a Vserver) and the token counters in /proc/virtual/<xid>/sched 
do no go up at all.

I've read something about the CPU time accounting not working for KVM, but 
I think it's been fixed in the latest kernels.

I did my tests on 2.6.27.5-vs2.3.0.35.9 (I used the patch in Experimental 
for 2.6.27.4, which applies to 2.6.27.5 cleanly as well).

I think it'd be neat to be able to control KVM guests with the VServer 
token-bucket scheduler.

Grisha

On Thu, 6 Nov 2008, Gregory (Grisha) Trubetskoy wrote:

>
> I've been able to start the KVM QEMU in a VServer guest without any problems, 
> and with prettu much default configuration, i.e. no special [b]caps were 
> needed (haven't quite figured out the networking part though).
>
> All I needed was a /dev/kvm in a guest (and the kvm kernel modules loaded, as 
> well as a VT capable CPU, of course).
>
> I wonder if anyone else here has played with this? What are security 
> implications of a guest having a /dev/kvm? Can a guest with access to 
> /dev/kvm wreak havoc on other KVM's (possibly running in other guests or in 
> the host)?
>
> Grisha
>
>