From 617da6a3796eda79cc5f13e4a128e4d80d720925 Mon Sep 17 00:00:00 2001 From: Ian Jackson Date: Mon, 14 Jan 2019 14:59:35 +0000 Subject: [PATCH] docs/features/qemu-deprivilege.pandoc: No support with Linux <2.6.18 Some early kernels are known not to reject unknown flags to unshare(). There may be other problems. CC: Jan Beulich Signed-off-by: Ian Jackson Acked-by: Wei Liu Release-acked-by: Juergen Gross --- docs/features/qemu-deprivilege.pandoc | 3 +++ 1 file changed, 3 insertions(+) diff --git a/docs/features/qemu-deprivilege.pandoc b/docs/features/qemu-deprivilege.pandoc index eb05981a83..20d6ac2189 100644 --- a/docs/features/qemu-deprivilege.pandoc +++ b/docs/features/qemu-deprivilege.pandoc @@ -112,6 +112,9 @@ The following features still need to be implemented: * Inserting a new cdrom while the guest is running (xl cdrom-insert) * Migration / save / restore +dm_restrict is totally unsupported and may have unexpected security +problems if used with a dom0 Linux kernel earlier than 2.6.18. + Additionally, getting PCI passthrough to work securely would require a significant rework of how passthrough works at the moment. It may be implemented at some point but is not a near-term priority. -- 2.30.2