bug#36335: Is /dev/kvm missing ACLs?

bug#36335: Is /dev/kvm missing ACLs?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 1323 bytes --]

Hi,

I was trying to run some VMs via "guix system vm", and I noticed that
I didn't have permission to use KVM.  This issue can be worked around by
running qemu as root, or by adding yourself to the "kvm" group.
However, I found it curious that the /dev/kvm device didn't have ACLs
granting me access:

--8<---------------cut here---------------start------------->8---
$ getfacl /dev/kvm
getfacl: Removing leading '/' from absolute path names
# file: dev/kvm
# owner: root
# group: kvm
user::rw-
group::rw-
other::---
--8<---------------cut here---------------end--------------->8---

Is it expected that on Guix System, /dev/kvm does not by default receive
ACLs granting me access?  I'm logged into a GNOME session via GDM, and I
was under the impression that logind or udevd would automatically set up
ACLs for me to access local devices, such as /dev/kvm and /dev/sr0, in
this case.

Note that I DO have ACLs for some other devices, such as video0:

--8<---------------cut here---------------start------------->8---
$ getfacl /dev/video0
getfacl: Removing leading '/' from absolute path names
# file: dev/video0
# owner: root
# group: video
user::rw-
user:marusich:rw-
group::rw-
mask::rw-
other::---
--8<---------------cut here---------------end--------------->8---

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

bug#36335: Is /dev/kvm missing ACLs?

[Ludovic Courtès]

Hi Chris,

Chris Marusich <cmmarusich@gmail.com> skribis:

> I was trying to run some VMs via "guix system vm", and I noticed that
> I didn't have permission to use KVM.  This issue can be worked around by
> running qemu as root, or by adding yourself to the "kvm" group.
> However, I found it curious that the /dev/kvm device didn't have ACLs
> granting me access:
>
> $ getfacl /dev/kvm
> getfacl: Removing leading '/' from absolute path names
> # file: dev/kvm
> # owner: root
> # group: kvm
> user::rw-
> group::rw-
> other::---
>
>
> Is it expected that on Guix System, /dev/kvm does not by default receive
> ACLs granting me access?

Guix System doesn’t use ACLs at all.

However, the udev rule for kvm sets it up like this:

  crw-rw---- 1 root kvm 10, 232 Jun 24 08:38 /dev/kvm

and the build users are part of the ‘kvm’ group.  I personally arrange
to have my user account in that group too.

Thanks,
Ludo’.

bug#36335: Is /dev/kvm missing ACLs?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 901 bytes --]

Hi Ludo,

Ludovic Courtès <ludo@gnu.org> writes:

> Guix System doesn’t use ACLs at all.
>
> However, the udev rule for kvm sets it up like this:
>
>   crw-rw---- 1 root kvm 10, 232 Jun 24 08:38 /dev/kvm
>
> and the build users are part of the ‘kvm’ group.  I personally arrange
> to have my user account in that group too.

It's good to know that the "kvm" group is the right way to grant
permissions.  However, if Guix System doesn't use ACLs, then why do some
of my device files have ACLs on them, such as the video device file?

--8<---------------cut here---------------start------------->8---
$ getfacl /dev/video0 
getfacl: Removing leading '/' from absolute path names
# file: dev/video0
# owner: root
# group: video
user::rw-
user:marusich:rw-
group::rw-
mask::rw-
other::---
--8<---------------cut here---------------end--------------->8---

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

bug#36335: Is /dev/kvm missing ACLs?

[Ludovic Courtès]

Hi Chris,

Chris Marusich <cmmarusich@gmail.com> skribis:

> Ludovic Courtès <ludo@gnu.org> writes:
>
>> Guix System doesn’t use ACLs at all.
>>
>> However, the udev rule for kvm sets it up like this:
>>
>>   crw-rw---- 1 root kvm 10, 232 Jun 24 08:38 /dev/kvm
>>
>> and the build users are part of the ‘kvm’ group.  I personally arrange
>> to have my user account in that group too.
>
> It's good to know that the "kvm" group is the right way to grant
> permissions.  However, if Guix System doesn't use ACLs, then why do some
> of my device files have ACLs on them, such as the video device file?
>
> $ getfacl /dev/video0 
> getfacl: Removing leading '/' from absolute path names
> # file: dev/video0
> # owner: root
> # group: video
> user::rw-
> user:marusich:rw-
> group::rw-
> mask::rw-
> other::---

Good question, I see the same thing here.

I suspected a udev rule but ‘grep’ didn’t find any that explicitly does
that, and there’s no code in eudev that fiddles with ACLs either, and
nothing obvious in devtmpfs.c in Linux.  So… it’s a mystery.

Ludo’.

bug#36335: Is /dev/kvm missing ACLs?

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 354 bytes --]

On Thu, 27 Jun 2019 15:45:33 +0200
Ludovic Courtès <ludo@gnu.org> wrote:

> I suspected a udev rule but ‘grep’ didn’t find any that explicitly does
> that, and there’s no code in eudev that fiddles with ACLs either, and
> nothing obvious in devtmpfs.c in Linux.  So… it’s a mystery.

Might be elogind.  It sets some ACLs on login.


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]

bug#36335: Is /dev/kvm missing ACLs?

[Chris Marusich]

[-- Attachment #1: Type: text/plain, Size: 1992 bytes --]

Ludovic Courtès <ludo@gnu.org> writes:

> Hi Chris,
>
> Chris Marusich <cmmarusich@gmail.com> skribis:
>
>> Ludovic Courtès <ludo@gnu.org> writes:
>>
>>> Guix System doesn’t use ACLs at all.
>>>
>>> However, the udev rule for kvm sets it up like this:
>>>
>>>   crw-rw---- 1 root kvm 10, 232 Jun 24 08:38 /dev/kvm
>>>
>>> and the build users are part of the ‘kvm’ group.  I personally arrange
>>> to have my user account in that group too.
>>
>> It's good to know that the "kvm" group is the right way to grant
>> permissions.  However, if Guix System doesn't use ACLs, then why do some
>> of my device files have ACLs on them, such as the video device file?
>>
>> $ getfacl /dev/video0 
>> getfacl: Removing leading '/' from absolute path names
>> # file: dev/video0
>> # owner: root
>> # group: video
>> user::rw-
>> user:marusich:rw-
>> group::rw-
>> mask::rw-
>> other::---
>
> Good question, I see the same thing here.
>
> I suspected a udev rule but ‘grep’ didn’t find any that explicitly does
> that, and there’s no code in eudev that fiddles with ACLs either, and
> nothing obvious in devtmpfs.c in Linux.  So… it’s a mystery.
>
> Ludo’.

Danny Milosavljevic <dannym@scratchpost.org> writes:

> On Thu, 27 Jun 2019 15:45:33 +0200
> Ludovic Courtès <ludo@gnu.org> wrote:
>
>> I suspected a udev rule but ‘grep’ didn’t find any that explicitly does
>> that, and there’s no code in eudev that fiddles with ACLs either, and
>> nothing obvious in devtmpfs.c in Linux.  So… it’s a mystery.
>
> Might be elogind.  It sets some ACLs on login.

Might be.

I am content knowing that on Guix System, the intended way to control
access to /dev/kvm is by using the "kvm" group.  However, it still
smells like we may have an ACL-related bug: It seems to be unexpected
that ACLs are getting set for some devices (e.g., /dev/video0), but not
for others (e.g., /dev/kvm).

What do you think?

-- 
Chris

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 832 bytes --]

bug#36335: Is /dev/kvm missing ACLs?

[Ludovic Courtès]

Hi,

Chris Marusich <cmmarusich@gmail.com> skribis:

> I am content knowing that on Guix System, the intended way to control
> access to /dev/kvm is by using the "kvm" group.  However, it still
> smells like we may have an ACL-related bug: It seems to be unexpected
> that ACLs are getting set for some devices (e.g., /dev/video0), but not
> for others (e.g., /dev/kvm).
>
> What do you think?

I agree.  I’d like to have a definite answer as to where these come
from; elogind was suspect #1 but I haven’t found anything conclusive.

Ludo’.

bug#36335: Is /dev/kvm missing ACLs?

[Danny Milosavljevic]

[-- Attachment #1: Type: text/plain, Size: 140 bytes --]

auditd can find those acl setters :)

# auditctl -w /dev/kvm -p a -k kvm-acl-setter-foo

Later on:

# ausearch -k kvm-acl-setter-foo

[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 488 bytes --]