[pve-devel] [PATCH qemu-server] fix #5657: allow configuring RNG device as non-root user

[pve-devel] [PATCH qemu-server] fix #5657: allow configuring RNG device as non-root user

[Filip Schauer]

Allow any user with the VM.Config.HWType permission to add or remove a
VirtIO RNG device on a VM. This is in line with the behaviour of cloning
a VM and restoring a VM backup as defined in
PVE::QemuServer::check_mapping_access.

Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
---
 PVE/API2/Qemu.pm | 1 +
 1 file changed, 1 insertion(+)

diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
index d25a79f..5ab65f9 100644
--- a/PVE/API2/Qemu.pm
+++ b/PVE/API2/Qemu.pm
@@ -592,6 +592,7 @@ my $hwtypeoptions = {
     'vga' => 1,
     'watchdog' => 1,
     'audio0' => 1,
+    'rng0' => 1,
 };
 
 my $generaloptions = {
-- 
2.39.2



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH qemu-server] fix #5657: allow configuring RNG device as non-root user

[Fabian Grünbichler]

On August 26, 2024 1:08 pm, Filip Schauer wrote:
> Allow any user with the VM.Config.HWType permission to add or remove a
> VirtIO RNG device on a VM. This is in line with the behaviour of cloning
> a VM and restoring a VM backup as defined in
> PVE::QemuServer::check_mapping_access.

IIRC this was intentional, since passing in the hardware RNG can starve
the host of entropy rather quickly. is this no longer the case, or
handled by some other check? if so, please include these details here.
if not, then I don't think we want to go with this patch - but maybe we
want to tighten some other code paths instead ;)

> 
> Signed-off-by: Filip Schauer <f.schauer@proxmox.com>
> ---
>  PVE/API2/Qemu.pm | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/PVE/API2/Qemu.pm b/PVE/API2/Qemu.pm
> index d25a79f..5ab65f9 100644
> --- a/PVE/API2/Qemu.pm
> +++ b/PVE/API2/Qemu.pm
> @@ -592,6 +592,7 @@ my $hwtypeoptions = {
>      'vga' => 1,
>      'watchdog' => 1,
>      'audio0' => 1,
> +    'rng0' => 1,
>  };
>  
>  my $generaloptions = {
> -- 
> 2.39.2
> 
> 
> 
> _______________________________________________
> pve-devel mailing list
> pve-devel@lists.proxmox.com
> https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel
> 
> 
> 


_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel

Re: [pve-devel] [PATCH qemu-server] fix #5657: allow configuring RNG device as non-root user

[Filip Schauer]

On 02/09/2024 14:21, Fabian Grünbichler wrote:
> IIRC this was intentional, since passing in the hardware RNG can starve
> the host of entropy rather quickly. is this no longer the case, or
> handled by some other check? if so, please include these details here.
> if not, then I don't think we want to go with this patch - but maybe we
> want to tighten some other code paths instead 😉


Reading from /dev/urandom has never consumed entropy and reading from
/dev/random no longer poses a concern since the kernel no longer uses a
blocking entropy pool. [1] The only potential issue might be the
starvation of the hardware RNG when /dev/hwrng is used. So we might not
want to allow a non-root user to configure /dev/hwrng, but letting
non-root users configure the other two options (/dev/urandom and
/dev/random) seems reasonable.

It might make sense to only allow non-root users to configure
/dev/urandom and /dev/random as RNG sources.

[1] https://lwn.net/Articles/808575/



_______________________________________________
pve-devel mailing list
pve-devel@lists.proxmox.com
https://lists.proxmox.com/cgi-bin/mailman/listinfo/pve-devel