libs: protection: x86_64: drop root requirement for querying

It is no longer necessary to be `root` to query the guest protection
(TDX) on `x86_64` systems, so drop the requirement.

> **Note:**
>
> This change drops the `nix` `Uid` import required for the `root` check.
> But at the same time it adds it for PPC64le since that implementation of
> `available_guest_protection()` needs it and it was previously missing.

Fixes: #8548.

Signed-off-by: James O. D. Hunt <james.o.hunt@intel.com>
This commit is contained in:
James O. D. Hunt
2023-12-01 14:01:58 +00:00
parent 818b8f93b1
commit f05ada592f

View File

@@ -13,7 +13,7 @@ use std::path::Path;
use std::path::PathBuf;
use thiserror::Error;
#[cfg(any(target_arch = "s390x", target_arch = "x86_64"))]
#[cfg(any(target_arch = "s390x", target_arch = "powerpc64le"))]
use nix::unistd::Uid;
#[cfg(target_arch = "x86_64")]
@@ -97,10 +97,6 @@ const TDX_MINOR_FILE: &str = "minor_version";
#[cfg(target_arch = "x86_64")]
pub fn available_guest_protection() -> Result<GuestProtection, ProtectionError> {
if !Uid::effective().is_root() {
return Err(ProtectionError::NoPerms);
}
arch_guest_protection(
TDX_SYS_FIRMWARE_DIR,
SEV_KVM_PARAMETER_PATH,
@@ -262,23 +258,10 @@ pub fn available_guest_protection() -> Result<GuestProtection, ProtectionError>
#[cfg(test)]
mod tests {
use super::*;
use nix::unistd::Uid;
use std::fs;
use std::io::Write;
use tempfile::tempdir;
#[test]
fn test_available_guest_protection_no_privileges() {
if !Uid::effective().is_root() {
let res = available_guest_protection();
assert!(res.is_err());
assert_eq!(
"No permission to check guest protection",
res.unwrap_err().to_string()
);
}
}
#[test]
fn test_arch_guest_protection_snp() {
// Test snp