[PATCH 1/2] container-entrypoint: add kvm group id provided

[Jose Quaresma]

Grant the build user access to /dev/kvm if requested. The device is
passed with its host GID, which won't match any container group, so
create/point a group at that GID and add builder to it. gosu picks up
supplementary groups.

Signed-off-by: Jose Quaresma <jose.q...@oss.qualcomm.com>
---
container-entrypoint | 17 +++++++++++++++++
1 file changed, 17 insertions(+)

diff --git a/container-entrypoint b/container-entrypoint
index 0725a8c..71f0892 100755
--- a/container-entrypoint
+++ b/container-entrypoint
@@ -104,6 +104,22 @@ restore_managed_dirs_owner()
chown_managed_dirs 0 0
}

+# Grant the build user access to /dev/kvm if requested. The device is
+# passed with its host GID, which won't match any container group, so
+# create/point a group at that GID and add builder to it. gosu picks up
+# supplementary groups, so no host-side permission change is needed.
+add_kvm_group_id()
+{
+ if [ -n "$KAS_ENABLE_KVM" ] && [ -c /dev/kvm ]; then
+ KVM_GID=$(stat -c '%g' /dev/kvm)
+ if ! kvm_grp=$(getent group "$KVM_GID" | cut -d: -f1) || [ -z "$kvm_grp" ]; then
+ kvm_grp=hostkvm
+ groupadd --non-unique --gid "$KVM_GID" "$kvm_grp"
+ fi
+ usermod --append --groups "$kvm_grp" builder
+ fi
+}
+
if mount | grep -q "on / type aufs"; then
cat <<EOF >&2
WARNING: Generation of wic images will fail!
@@ -139,6 +155,7 @@ else

groupmod -o --gid "$GROUP_ID" builder
usermod -o --uid "$USER_ID" --gid "$GROUP_ID" builder >/dev/null
+ add_kvm_group_id
chown -R "$USER_ID":"$GROUP_ID" /builder
# copy host SSH config into home of builder
if [ -d /var/kas/userdata/.ssh ]; then
--
2.55.0

[Jose Quaresma]

Pass /dev/kvm into the container (for runqemu/testimage KVM acceleration)
and grant the build user access to it.

Signed-off-by: Jose Quaresma <jose.q...@oss.qualcomm.com>
---

kas-container | 14 ++++++++++++++
1 file changed, 14 insertions(+)

diff --git a/kas-container b/kas-container
index 55bdcfc..16d1f47 100755
--- a/kas-container
+++ b/kas-container
@@ -70,6 +70,8 @@ usage()
"To force the use\n"
printf "%b" "\t\t\tof run0 over sudo, set KAS_SUDO_CMD=run0.\n"
printf "%b" "--isar-rootless\t\tRun an Isar build in rootless mode.\n"
+ printf "%b" "--kvm\t\tPass /dev/kvm into the container (for runqemu/testimage KVM\n" \
+ "acceleration) and grant the build user access to it."
printf "%b" "--runtime-args\t\tAdditional arguments to pass to the " \
"container runtime.\n"
printf "%b" "\t\t\tfor running the build.\n"
@@ -344,6 +346,10 @@ while [ $# -gt 0 ]; do
BUILD_SYSTEM="isar-rootless"
shift 1
;;
+ --kvm)
+ KAS_KVM="1"
+ shift 1
+ ;;
--runtime-args | --docker-args)
[ $# -gt 1 ] || usage
KAS_EXTRA_RUNTIME_ARGS="${KAS_EXTRA_RUNTIME_ARGS} $2"
@@ -691,6 +697,14 @@ if [ -n "${AWS_WEB_IDENTITY_TOKEN_FILE}" ] ; then
-e AWS_ROLE_ARN="${AWS_ROLE_ARN}"
fi

+if [ -n "${KAS_KVM}" ]; then
+ if [ -c /dev/kvm ]; then
+ set -- "$@" --device=/dev/kvm -e KAS_ENABLE_KVM=1
+ else
+ warning "--kvm given but /dev/kvm not present on host; skipping"
+ fi
+fi
+
KAS_GIT_CREDENTIAL_HELPER_DEFAULT=""

if [ -n "${KAS_GIT_CREDENTIAL_STORE}" ] ; then
--
2.55.0

[Jan Kiszka]

On 13.07.26 18:51, 'Jose Quaresma' via kas-devel wrote:
> Grant the build user access to /dev/kvm if requested. The device is
> passed with its host GID, which won't match any container group, so
> create/point a group at that GID and add builder to it. gosu picks up
> supplementary groups.

Could you also provide the use case along the "what" you are doing here?

Some reasoning on why we want that kvm as opt-in would also be useful. I
think most distros are adding normal users to the kvm group by default
now - which is not yet suggesting we should do the same here.

Jan

Siemens AG, Foundational Technologies
Linux Expert Center