Re: [Qemu-devel] [PATCH RFC] tcmu: Introduce qemu-tcmu

[Andy Grover]

On 10/20/2016 07:30 AM, Fam Zheng wrote:
> On Thu, 10/20 15:08, Stefan Hajnoczi wrote:
> > If a corrupt image is able to execute arbitrary code in the qemu-tcmu
> > process, does /dev/uio0 or the tcmu shared memory interface allow get
> > root or kernel privileges?
>
> I haven't audited the code, but target_core_user.ko should contain the access to
> /dev/uioX and make sure there is no security risk regarding buggy or malicious
> handlers. Otherwise it's a bug that should be fixed. Andy can correct me if I'm
> wrong.

Yes... well, TCMU ensures that a bad handler can't scribble to kernel 
memory outside the shared memory area.

UIO devices are basically a "device drivers in userspace" kind of API so 
they require root to use. I seem to remember somebody mentioning ways 
this might work for less-privileged handlers (fd-passing??) but no way 
to do this exists just yet.

Regards -- Andy