From: Corey Bryant <coreyb@linux.vnet.ibm.com>
To: qemu-devel@nongnu.org
Cc: aliguori@us.ibm.com, rmarwah@linux.vnet.ibm.com
Subject: [Qemu-devel] [PATCH v6 0/4] -net bridge: rootless bridge support for qemu
Date: Mon, 19 Dec 2011 08:11:54 -0500 [thread overview]
Message-ID: <1324300318-3419-1-git-send-email-coreyb@linux.vnet.ibm.com> (raw)
With qemu it is possible to run a guest from an unprivileged user but if
we wanted to communicate with the outside world we had to switch
to root.
We address this problem by introducing a new network backend and a new
network option for -net tap. This is less flexible when compared to
existing -net tap options because it relies on a helper with elevated
privileges to do the heavy lifting of allocating and attaching a tap
device to a bridge. We use a special purpose helper because we don't
want to elevate the privileges of more generic tools like brctl.
Qemu can be run with the default network helper as follows (in these cases
attaching the tap device to the default br0 bridge):
qemu linux.img -net bridge -net nic,model=virtio
qemu linux.img -net tap,helper=/usr/local/libexec/qemu-bridge-helper
-net nic,model=virtio
qemu linux.img -netdev bridge,id=hn0
-device virtio-net-pci,netdev=hn0,id=nic1
qemu linux.img -netdev tap,helper=/usr/local/libexec/qemu-bridge-helper,id=hn0
-device virtio-net-pci,netdev=hn0,id=nic1
The default helper uses it's own ACL mechanism for access control, but
future network helpers could be developed, for example, to support PolicyKit
for access control.
More details are included in individual patches. The helper is broken into
a series of patches to improve reviewabilty.
v2:
- Updated signed-off-by's
- Updated author's email
- Set default bridge to br0
- Added -net bridge
- Updated ACL example
- Moved from libcap to libcap-ng
- Fail helper when libcap-ng not configured
v3:
- Use simple queue to store ACLs
- Added goto cleanup to helper's main
- Allow helper execution if libcap-ng not configured
- Completed static analysis and memory analysis on helper
v4:
- Update has_vnet_hdr() to return bool
- Update helper's main() to prevent errno clobbering
- Let Kernel cleanup helper's file descriptors
v5:
- Removed if statement with TUNGETIFF ioctl() from has_vnet_hdr()
- Added -netdev examples and udpated qemu -help netdev documentation
- Disallow vnet_hdr option with -net tap,helper
v6:
- Fixed uninitialized variable (TAPState *s) in net_tap_init()
Corey Bryant (4):
Add basic version of bridge helper
Add access control support to qemu bridge helper
Add cap reduction support to enable use as SUID
Add support for net bridge
Makefile | 12 ++-
configure | 37 +++++
net.c | 29 ++++-
net.h | 3 +
net/tap.c | 187 +++++++++++++++++++++++-
net/tap.h | 3 +
qemu-bridge-helper.c | 402 ++++++++++++++++++++++++++++++++++++++++++++++++++
qemu-options.hx | 74 ++++++++--
8 files changed, 728 insertions(+), 19 deletions(-)
create mode 100644 qemu-bridge-helper.c
--
1.7.3.4
next reply other threads:[~2011-12-19 13:12 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-12-19 13:11 Corey Bryant [this message]
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 1/4] Add basic version of bridge helper Corey Bryant
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 2/4] Add access control support to qemu " Corey Bryant
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 3/4] Add cap reduction support to enable use as SUID Corey Bryant
2011-12-19 13:11 ` [Qemu-devel] [PATCH v6 4/4] Add support for net bridge Corey Bryant
2011-12-19 19:36 ` Anthony Liguori
2011-12-19 22:55 ` Corey Bryant
2011-12-19 23:15 ` Anthony Liguori
2011-12-20 17:13 ` Corey Bryant
2011-12-22 15:54 ` Anthony Liguori
2011-12-20 10:02 ` Hui Kai Ran
2011-12-20 10:58 ` Hui Kai Ran
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=1324300318-3419-1-git-send-email-coreyb@linux.vnet.ibm.com \
--to=coreyb@linux.vnet.ibm.com \
--cc=aliguori@us.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=rmarwah@linux.vnet.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.