Re: [Qemu-devel] [PATCH 0/4] net-bridge: rootless bridge support for qemu

[Jamie Lokier]

Avi Kivity wrote:
> On 11/05/2009 05:59 PM, Anthony Liguori wrote:
> >Avi Kivity wrote:
> >>On 11/05/2009 05:11 PM, Daniel P. Berrange wrote:
> >>>The main problem is that we've never really used the 'session' 
> >>>instances,
> >>>since networking configs are rather limited to pretty much just SLIRP
> >>>and people expect full bridging.  I think this patch series you've
> >>>done is invaluable and will let us finally make full use of the libvirt
> >>>'session' instances for desktop virt, running everything unprivileged.
> >>>
> >>
> >>What's to stop you from using the same idea to get a tap fd for the 
> >>unprivileged libvirtd instance?
> >
> >Why limit this to just libvirt based management tools?  The helper has 
> >to live somewhere, why not have it live in qemu?
> >
> 
> Because anything special the management tools wants done (as simple as 
> remembering the interface name so it can collect statistics and 
> associate them with the guest) will render the helper unusable.  The 
> helper is pure glue so it will be very hard to generalize.

The management tool can provide it's own helper program to QEMU, which
can communicate with the management tool... via a side channel, so the
management tool as a whole can do anything it wants when QEMU requests
the tap interface.  Getting the interface name and inserting
iptables/ebtables rules would be quite simple that way.

-- Jamie