From nobody Fri Jan 16 17:06:01 2026 X-Original-To: freebsd-virtualization@mlmmj.nyi.freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [IPv6:2610:1c1:1:606c::19:1]) by mlmmj.nyi.freebsd.org (Postfix) with ESMTP id 4dt5ph5gc0z6NYLK for ; Fri, 16 Jan 2026 17:06:04 +0000 (UTC) (envelope-from markj@freebsd.org) Received: from smtp.freebsd.org (smtp.freebsd.org [96.47.72.83]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256 client-signature RSA-PSS (4096 bits) client-digest SHA256) (Client CN "smtp.freebsd.org", Issuer "R12" (verified OK)) by mx1.freebsd.org (Postfix) with ESMTPS id 4dt5ph4qDkz3d4Z for ; Fri, 16 Jan 2026 17:06:04 +0000 (UTC) (envelope-from markj@freebsd.org) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768583164; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=qgjGt6cl6uPsGQCFGoe61fHbqats9fg/nVju3QQQbYY=; b=avgwvcOi1P6rimVtxZ3inzv8RbiRRfZGl9N70nx3allih45CpiHek06BY/a7aQpr963aty 14RJkqk2JsvjLVfHfkzYJxSyZuBJ5dswg/SXlUMm8AoQ5OAN1jg3iuQG28xl8W+hRLYS4W UjD39HerLbJmbmEZWOWl8ZxWnq+K9SA5I1U8w0qVR2EBKrW6jhPoXISjrH7Gdel9czldIj kgPD8rgxvlGyZAANSr8P6vXwGmN6GWRnDfD4zdFOs1/o+SgypB9K2BC5iqXFsDZQXva6BP szLIZ5znlFMU2HjVBgmvEEDgAPBfA9HyHnkFj3TMERK+E7aVw0xmVkayUHjXtg== ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=freebsd.org; s=dkim; t=1768583164; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:mime-version:mime-version:content-type:content-type; bh=qgjGt6cl6uPsGQCFGoe61fHbqats9fg/nVju3QQQbYY=; b=pl8bl4UXge55HTlB4cByoeAAT4/dTVUv9KOqh0jboAUwma6cSc771DbM2HHkc6jeWb5AMD NOAFW0tjKSXdfaf6unzYnEhv+lUGI/2JKwCBG2+o7qBDMFvfqrxGMGsPFu9GMMYXbT96Ab HlbyXScnhN6VatrcKvpV8ktdDTx2jue8lAu2cVsub7rcM74vCjoUv9rdVPeOj39nUYVEPw +JflMj06lU9eriXTAEstnULW5CcVMff8y0d6jA29uEBbtqJZ31W3r/2o9g9gsyGH2OV0xs TMLyJCS2tndfLqkEqEOWHJpSrCK7bqhDSBZjXKCC4L7sVwKuykzLwoyIjqXkeg== ARC-Seal: i=1; s=dkim; d=freebsd.org; t=1768583164; a=rsa-sha256; cv=none; b=tyYDvsKhxHZhNnl5RaajtvxQYcZqBqyFHKyRDIErfKW9q8Qqq8C8tSRHt63Yxgj0v++u1f j5sndj3uDnh2rUnb+RcwIHLMtaGq7+URgUoWXh/iDZTVuTDUARwwvARfK+5VkTHwQtEJi1 XZBgFisKnlCc95GW7iKVQi/s/Zd0+LDDjqx4oUSZehSyReBIvj4BmQn+yGIwxkwQ+pqUKu aR3is6urW/UYFPVaeGwSftraSO/2u6Rmb9npQrgNJH0by2ZCUIIPfeyj33Kzr9gc+Tk5W4 hWStCw6vttGDQALcskjaOUYKZZgyHh/ICquhwUbNnGHqvF54iN5rlpHWWKt19w== ARC-Authentication-Results: i=1; mx1.freebsd.org; none Received: from nuc (192-0-220-237.cpe.teksavvy.com [192.0.220.237]) (using TLSv1.3 with cipher TLS_AES_256_GCM_SHA384 (256/256 bits) key-exchange X25519 server-signature RSA-PSS (4096 bits) server-digest SHA256) (Client did not present a certificate) (Authenticated sender: markj) by smtp.freebsd.org (Postfix) with ESMTPSA id 4dt5ph3Cl9z15v6 for ; Fri, 16 Jan 2026 17:06:03 +0000 (UTC) (envelope-from markj@freebsd.org) Date: Fri, 16 Jan 2026 12:06:01 -0500 From: Mark Johnston To: freebsd-virtualization@freebsd.org Subject: new vmm group to enable non-root bhyve use Message-ID: List-Id: Discussion List-Archive: https://lists.freebsd.org/archives/freebsd-virtualization List-Help: List-Post: List-Subscribe: List-Unsubscribe: X-BeenThere: freebsd-virtualization@freebsd.org Sender: owner-freebsd-virtualization@FreeBSD.org MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Hi, I posted some patches for review which add a new "vmm" group and modify the default ownership and mode of /dev/vmmctl. The result is that regular users that belong to the vmm group will be able to create and run bhyve VMs, albeit with some caveats: - They must run bhyve in "monitor mode", i.e., with -M, to ensure that the VM is destroyed automatically upon last close. - PCI passthru cannot be used. - The user of course needs to be able to access any filesystem resources specified in the bhyve configuration, e.g., disk files or tap devices. Note that the slirp networking backend has recently gotten some improvements and can be used as an unprivileged user. The /dev/vmm* device files for a particular VM are owned by the user that created the VM, so the same user can inspect and destroy the VM with bhyvectl. The patch series starts here (follow the linked revisions in the "stack" tab): https://reviews.freebsd.org/D54739 Any feedback or comments would be appreciated.