Subject: KVM in a guest, security implications?
From: "Gregory (Grisha) Trubetskoy" <grisha@apache.org>
Date: Thu, 6 Nov 2008 18:25:40 -0500 (EST)


I've been able to start the KVM QEMU in a VServer guest without any 
problems, and with prettu much default configuration, i.e. no special 
[b]caps were needed (haven't quite figured out the networking part 
though).

All I needed was a /dev/kvm in a guest (and the kvm kernel modules loaded, 
as well as a VT capable CPU, of course).

I wonder if anyone else here has played with this? What are security 
implications of a guest having a /dev/kvm? Can a guest with access to 
/dev/kvm wreak havoc on other KVM's (possibly running in other guests or 
in the host)?

Grisha