Subject: Re: [vserver] KVM in a guest, security implications?
From: Herbert Poetzl <herbert@13thfloor.at>
Date: Tue, 11 Nov 2008 18:00:36 +0100

On Sat, Nov 08, 2008 at 04:53:06PM -0500, Gregory (Grisha) Trubetskoy wrote:
> 
> To follow up on my post, it seems that the Vserver scheduler has
> no effect on the KVM processes. You can have a very intensive task
> in a KVM (QEMU running in a Vserver) and the token counters in
> /proc/virtual/<xid>/sched do no go up at all.
> 
> I've read something about the CPU time accounting not working for KVM,
> but I think it's been fixed in the latest kernels.
> 
> I did my tests on 2.6.27.5-vs2.3.0.35.9 (I used the patch in
> Experimental for 2.6.27.4, which applies to 2.6.27.5 cleanly as well).
> 
> I think it'd be neat to be able to control KVM guests with the VServer
> token-bucket scheduler.

the TBS is (currently) off, since the mainline scheduler
was changed to CFS (completely fair scheduler), no idea
if the KVM time tracking needs special support or not,
you might want to figure that and, if yes, provide a
patch to add proper accounting

best,
Herbert

> Grisha
> 
> On Thu, 6 Nov 2008, Gregory (Grisha) Trubetskoy wrote:
> 
> >
> >I've been able to start the KVM QEMU in a VServer guest without any 
> >problems, and with prettu much default configuration, i.e. no special 
> >[b]caps were needed (haven't quite figured out the networking part 
> >though).
> >
> >All I needed was a /dev/kvm in a guest (and the kvm kernel modules 
> >loaded, as well as a VT capable CPU, of course).
> >
> >I wonder if anyone else here has played with this? What are security 
> >implications of a guest having a /dev/kvm? Can a guest with access to 
> >/dev/kvm wreak havoc on other KVM's (possibly running in other guests or 
> >in the host)?
> >
> >Grisha
> >
> >