Required Permissions
====================

The i7z/i7z_rw_registers tools require *write* permissions to
the machine state registers (msr) via /dev/cpu/*/msr, which usually
means to run these tools as root. Doing improper stuff with the msr
can crash your system.

I wouldn't recommend making i7z a setuid root executable - the code is
too poorly written and giving it setuid permissions may easily result
in a security hole.

The following instructions should allow one to set permissions for i7z
to be used by certain normal users.

THESE INSTRUCTIONS COME WITHOUT ANY WARRANTY.
USE THEM ON YOUR OWN RESPONSIBILITY!

* Add a new system group 'msr' and put a user in there:

  # addgroup --system msr
  # adduser <LOGIN> msr

* Load the msr kernel module and set the permissions, this will have
  to be performed after each reboot (or after unloading+reloading the
  msr module).

  # modprobe msr
  # chgrp msr /dev/cpu/*/msr
  # chmod 660 /dev/cpu/*/msr

* Accessing the msr device nodes additionally requires the
  CAP_SYS_RAWIO capability. So restrict execution of i7z to
  the 'msr' group and set the capability. getcap/setcap can be found
  in the libcap2-bin package.
  Note: The setcap setting is not persistent over upgrades of the
  i7z package!

  # dpkg-statoverride --update --add root msr 0754 /usr/sbin/i7z
  # setcap cap_sys_rawio=ep /usr/sbin/i7z

Now a regular user in the 'msr' group should be able to run i7z.

* Undoing the dpkg-statoverride and setcap later on:

  # setcap -r /usr/sbin/i7z
  # dpkg-statoverride --remove /usr/sbin/i7z
