google/novm

Request: support for existing tap devices

pwaller opened this issue · 1 comments

I want to run novm as a user (which has access to /dev/kvm). I appreciate that the user may be able to escape, but I want to do it anyway. Apparently, the only thing preventing this from working is this call:

novm/novm/net.py

Lines 159 to 162 in 278237d

# Make sure the interface is up.
subprocess.check_call(
["/sbin/ip", "link", "set", "up", "dev", tapname],
close_fds=True)

It is possible to create tap devices which are owned by a user via, for example ip tuntap add dev pw mode tap user pwaller group pwaller. In this case, only root is able to modify the host side of the device, so root has to set the device up.

Could novm detect that the device is already up and then not bother trying to run ip link set up dev tapN?

I'm not interested in following this up for now, and it seems this project is not having any development.