Required Permissions
====================

The i7z/i7z_GUI/i7z_rw_registers tools require *write* permissions to
the machine state registers (msr) via /dev/cpu/*/msr, which usually
means to run these tools as root. Doing improper stuff with the msr
can crash your system.

Properly running an X application (i7z_GUI here) as root is a
challenge on its own, I cannot help there.

I wouldn't recommend making i7z a setuid root executable - the code is
too poorly written and giving it setuid permissions may easily result
in a security hole.

The following intructions should allow one to set permissions for i7z
and i7z_GUI to be used by certain normal users.

THESE INSTRUCTIONS COME WITHOUT ANY WARRANTY.
USE THEM ON YOUR OWN RESPONSIBILITY!

* Add a new system group 'msr' and put a user in there:

  # addgroup --system msr
  # adduser <LOGIN> msr

* Load the msr kernel module and set the permissions, this will have
  to be performed after each reboot (or after unloading+reloading the
  msr module).

  # modprobe msr
  # chgrp msr /dev/cpu/*/msr
  # chmod 660 /dev/cpu/*/msr

* Accessing the msr device nodes additionally requires the
  CAP_SYS_RAWIO capability. So restrict execution of i7z/i7z_GUI to
  the 'msr' group and set the capability. getcap/setcap can be found
  in the libcap2-bin package.
  Note: The setcap setting is not persistent over upgrades of the
  i7z(-gui) packages!

  # dpkg-statoverride --update --add root msr 0754 /usr/sbin/i7z
  # setcap cap_sys_rawio=ep /usr/sbin/i7z
  # dpkg-statoverride --update --add root msr 0754 /usr/sbin/i7z_GUI
  # setcap cap_sys_rawio=ep /usr/sbin/i7z_GUI

Now a regular user in the 'msr' group should be able to run
i7z/i7z_GUI.

* Undoing the dpkg-statoverride and setcap later on:

  # setcap -r /usr/sbin/i7z
  # dpkg-statoverride --remove /usr/sbin/i7z
  # setcap -r /usr/sbin/i7z_GUI
  # dpkg-statoverride --remove /usr/sbin/i7z_GUI
