I want to run novm as a user (which has access to /dev/kvm). I appreciate that the user may be able to escape, but I want to do it anyway. Apparently, the only thing preventing this from working is this call:
It is possible to create tap devices which are owned by a user via, for example ip tuntap add dev pw mode tap user pwaller group pwaller. In this case, only root is able to modify the host side of the device, so root has to set the device up.
Could novm detect that the device is already up and then not bother trying to run ip link set up dev tapN?
I want to run novm as a user (which has access to /dev/kvm). I appreciate that the user may be able to escape, but I want to do it anyway. Apparently, the only thing preventing this from working is this call:
https://github.com/google/novm/blob/278237d9ebcaea19695a08151e64555e634442f3/novm/net.py#L159-L162
It is possible to create tap devices which are owned by a user via, for example
ip tuntap add dev pw mode tap user pwaller group pwaller
. In this case, only root is able to modify the host side of the device, so root has to set the deviceup
.Could novm detect that the device is already up and then not bother trying to run
ip link set up dev tapN
?