From dc6a56a0db3ed3f9bc828e110041d25543421cd6 Mon Sep 17 00:00:00 2001 From: Ruben Hakobyan Date: Fri, 5 Jun 2026 00:43:53 -0700 Subject: [PATCH] vmm: vm_config: allow opening /dev/sev after landlock On KVM, an SEV-SNP guest opens /dev/sev at VM creation and passes its fd as kvm_sev_cmd.sev_fd. KVM uses it to issue the SNP_LAUNCH_* commands. The open happens after the landlock ruleset is applied, so grant rw access to /dev/sev when the sev_snp platform feature is enabled. Assisted-by: Claude:Opus-4.8 Signed-off-by: Ruben Hakobyan --- vmm/src/vm_config.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/vmm/src/vm_config.rs b/vmm/src/vm_config.rs index 5adf293ff..0ce723ffc 100644 --- a/vmm/src/vm_config.rs +++ b/vmm/src/vm_config.rs @@ -1242,6 +1242,11 @@ impl VmConfig { payload.apply_landlock(&mut landlock)?; } + #[cfg(feature = "sev_snp")] + if self.platform.as_ref().is_some_and(|p| p.sev_snp) { + landlock.add_rule_with_access(Path::new("/dev/sev"), "rw")?; + } + if let Some(tpm_config) = &self.tpm { tpm_config.apply_landlock(&mut landlock)?; }