[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing usin
From: |
Stefan Hajnoczi |
Subject: |
Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd |
Date: |
Thu, 17 May 2012 14:42:28 +0100 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Fri, May 04, 2012 at 11:28:47AM +0800, Zhi Yong Wu wrote:
> On Tue, May 1, 2012 at 11:31 PM, Stefan Hajnoczi
> <address@hidden> wrote:
> > Libvirt can take advantage of SELinux to restrict the QEMU process and
> > prevent
> > it from opening files that it should not have access to. This improves
> > security because it prevents the attacker from escaping the QEMU process if
> > they manage to gain control.
> >
> > NFS has been a pain point for SELinux because it does not support labels
> > (which
> > I believe are stored in extended attributes). In other words, it's not
> > possible to use SELinux goodness on QEMU when image files are located on
> > NFS.
> > Today we have to allow QEMU access to any file on the NFS export rather than
> > restricting specifically to the image files that the guest requires.
> >
> > File descriptor passing is a solution to this problem and might also come in
> > handy elsewhere. Libvirt or another external process chooses files which
> > QEMU
> > is allowed to access and provides just those file descriptors - QEMU cannot
> > open the files itself.
> >
> > This series adds the -open-hook-fd command-line option. Whenever QEMU
> > needs to
> > open an image file it sends a request over the given UNIX domain socket.
> > The
> > response includes the file descriptor or an errno on failure. Please see
> > the
> > patches for details on the protocol.
> >
> > The -open-hook-fd approach allows QEMU to support file descriptor passing
> > without changing -drive. It also supports snapshot_blkdev and other
> > commands
> By the way, How will it support them?
The problem with snapshot_blkdev is that closing a file and opening a
new file cannot be done by the QEMU process when an SELinux policy is in
place to prevent opening files.
The -open-hook-fd approach works even when the QEMU process is not
allowed to open files since file descriptor passing over a UNIX domain
socket is used to open files on behalf of QEMU.
Stefan
- Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd, (continued)
- Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Kevin Wolf, 2012/05/02
- Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Daniel P. Berrange, 2012/05/02
- Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Kevin Wolf, 2012/05/02
- Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Daniel P. Berrange, 2012/05/02
- Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Paolo Bonzini, 2012/05/02
- Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Anthony Liguori, 2012/05/03
Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Daniel P. Berrange, 2012/05/02
Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd, Zhi Yong Wu, 2012/05/03