Device 'kvm-pci-assign' could not be initialized

最新推荐文章于 2023-12-12 13:15:24 发布

原创最新推荐文章于 2023-12-12 13:15:24 发布 · 2.9k 阅读

0 ·

CC 4.0 BY-SA版权

系统虚拟化专栏收录该内容

50 篇文章

订阅专栏

本文档展示了如何配置libvirt和QEMU以确保虚拟机的安全运行。内容包括设置用户和组ID，以及如何通过禁用clear_emulator_capabilities来运行具有完全权限的虚拟机实例。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

/etc/libvirt/qemu.conf:

# The user ID for QEMU processes run by the system instance.
user = "root"

# The group ID for QEMU processes run by the system instance.
group = "root"
and

# If clear_emulator_capabilities is enabled, libvirt will drop all
# privileged capabilities of the QEmu/KVM emulator. This is enabled by
# default.
#
# Warning: Disabling this option means that a compromised guest can
# exploit the privileges and possibly do damage to the host.
#
clear_emulator_capabilities = 0
Note: This will make your guest run as root with all its capabilities (insecure)