Add a FAQ entry about KVM on Debian/Ubuntu

diff --git a/mkosi/resources/mkosi.md b/mkosi/resources/mkosi.md
index c5230452e549157686fdb79d2c527187668c4a3f..f68f8e77d3a534b180754f78a32e84fce4e20852 100644 (file)
--- a/mkosi/resources/mkosi.md
+++ b/mkosi/resources/mkosi.md
@@ -1925,6 +1925,23 @@ to build.
 
 Note that the minimum required Python version is 3.9.
 
+# Frequently Asked Questions (FAQ)
+
+- Why does `mkosi qemu` with KVM not work on Debian/Ubuntu?
+
+While other distributions are OK with allowing access to `/dev/kvm`, on
+Debian/Ubuntu this is only allowed for users in the `kvm` group. Because
+mkosi unshares a user namespace when running unprivileged, even if the
+calling user was in the kvm group, when mkosi unshares the user
+namespace to run unprivileged, it loses access to the `kvm` group and by
+the time we start `qemu` we don't have access to `/dev/kvm` anymore. As
+a workaround, you can change the permissions of the device nodes to
+`0666` which is sufficient to make KVM work unprivileged. To persist
+these settings across reboots, copy
+`/usr/lib/tmpfiles.d/static-nodes-permissions.conf` to
+`/etc/tmpfiles.d/static-nodes-permissions.conf` and change the mode of
+`/dev/kvm` from `0660` to `0666`.
+
 # REFERENCES
 * [Primary mkosi git repository on GitHub](https://github.com/systemd/mkosi/)
 * [mkosi — A Tool for Generating OS Images](https://0pointer.net/blog/mkosi-a-tool-for-generating-os-images.html) introductory blog post by Lennart Poettering