[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] detecting seccomp sandbox capability via QMP
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] detecting seccomp sandbox capability via QMP |
Date: |
Thu, 6 Dec 2012 09:11:01 +0000 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Tue, Dec 04, 2012 at 03:44:54PM -0600, Anthony Liguori wrote:
> "Daniel P. Berrange" <address@hidden> writes:
>
> > On Tue, Dec 04, 2012 at 01:13:46PM -0600, Anthony Liguori wrote:
> >> "Daniel P. Berrange" <address@hidden> writes:
> >>
> >> >
> >> > In the absence of any way to detect it via QMP, libvirt should fallback
> >> > to hardcoding it based on the version number. This presumes that QEMU was
> >> > built with it enabled in configure, but we've no other option for current
> >> > released 1.2/1.3 versions.
> >>
> >> echo quit | qemu -machine none -S -monitor stdio -vnc none -sandbox on
> >>
> >> A non-zero execute means QEMU doesn't support the option. This will
> >> work for any new command line option introduction and can be considered
> >> a "supported" way of probing for whether options are supported.
> >
> > One of the significant benefits to libvirt of the QMP based feature
> > detection, was that we no longer have to invoke QEMU multiple times
> > to query different data. I don't want to regress in this regard,
> > because invoking QEMU many times has a noticable performance impact
> > for some applications eg virt-sandbox were even 100ms delays are
> > relevant. So while what you describe does work, I don't think it
> > is a satisfactory approach for libvirt.
>
> Okay, so in terms of what exists today, I don't have a better option.
> But we could add:
>
> { 'enum': 'ConfigEntryType',
> 'data': [ 'number', 'string', 'bool', 'size' ] }
>
> { 'type': 'ConfigEntry',
> 'data': { 'name': 'str', 'type': 'ConfigEntryType' } }
>
> { 'type': 'ConfigSection',
> 'data': { 'name': 'str', 'fields': [ 'ConfigEntry' ] } }
>
> { 'command': 'query-config-schema',
> 'returns': [ 'ConfigSection' ] }
>
> This technically introspects config sections but obviously could be used
> to detect the availability of -sandbox.
>
> If it's useful, I can take a quick swing at implementing (or someone
> else certainly could).
I'm not sure I entirely understand what information a 'ConfigSection'
would represent. By config here, do you mean any command line argument
or something else ? Could you give a short example of the actual JSON
you envisage returning for this schema. Your suggestion sounds good,
but I want to make sure I'm not mis-understanding things :-)
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
- [Qemu-devel] detecting seccomp sandbox capability via QMP, Ján Tomko, 2012/12/03
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Luiz Capitulino, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Ján Tomko, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Luiz Capitulino, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Daniel P. Berrange, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Anthony Liguori, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Daniel P. Berrange, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Anthony Liguori, 2012/12/04
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP,
Daniel P. Berrange <=
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Anthony Liguori, 2012/12/06
- Re: [Qemu-devel] detecting seccomp sandbox capability via QMP, Daniel P. Berrange, 2012/12/06