All of lore.kernel.org
 help / color / mirror / Atom feed
From: Eric Blake <eblake@redhat.com>
To: Anthony Liguori <anthony@codemonkey.ws>
Cc: Kevin Wolf <kwolf@redhat.com>,
	Anthony Liguori <aliguori@us.ibm.com>,
	Stefan Hajnoczi <stefanha@linux.vnet.ibm.com>,
	libvir-list@redhat.com, Corey Bryant <coreyb@linux.vnet.ibm.com>,
	qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd
Date: Tue, 01 May 2012 16:15:38 -0600	[thread overview]
Message-ID: <4FA0608A.7070800@redhat.com> (raw)
In-Reply-To: <4FA05B63.3090301@codemonkey.ws>

[-- Attachment #1: Type: text/plain, Size: 1595 bytes --]

On 05/01/2012 03:53 PM, Anthony Liguori wrote:

>> I think (correct me if I'm wrong) libvirt should be aware of any file
>> that qemu
>> asks it to open. So from a security point of view, libvirt can prevent
>> opening a
>> file if it isn't affiliated with the guest.
> 
> Right, libvirt can maintain a whitelist of files QEMU is allowed to open
> (which is already has because it needs to label these files).

Indeed.

>  The only
> complexity is that it's not a straight strcmp().  The path needs to be
> (carefully) broken into components with '.' and '..' handled
> appropriately.  But this shouldn't be that difficult to do.

Libvirt would probably canonicalize path names, both when sticking them
in the whitelist, and in validating the requests from qemu - agreed that
it's not difficult.

More importantly, libvirt needs to start tracking the backing chain of
any qcow2 or qed file as part of the domain XML; and operations like
'block-stream' would update not only the chain, but also the whitelist.
 In the drive-reopen case, this means that libvirt would have to be
careful when to change labeling - provide access to the new files before
drive-reopen, then revoke access to files after drive-reopen completes.
 In other words, having the -open-hook-fd client pass a command to
libvirt at the time it is closing an fd would help libvirt know when
qemu has quit using a file, which might make it easier to revoke SELinux
labels at that time.

-- 
Eric Blake   eblake@redhat.com    +1-919-301-3266
Libvirt virtualization library http://libvirt.org


[-- Attachment #2: OpenPGP digital signature --]
[-- Type: application/pgp-signature, Size: 620 bytes --]

  reply	other threads:[~2012-05-01 22:15 UTC|newest]

Thread overview: 37+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2012-05-01 15:31 [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd Stefan Hajnoczi
2012-05-01 15:31 ` [Qemu-devel] [RFC 1/5] block: add open() wrapper that can be hooked by libvirt Stefan Hajnoczi
2012-05-01 15:31 ` [Qemu-devel] [RFC 2/5] block: add new command line parameter that and protocol description Stefan Hajnoczi
2012-05-02  8:58   ` Daniel P. Berrange
2012-05-02  9:03   ` Daniel P. Berrange
2012-05-01 15:31 ` [Qemu-devel] [RFC 3/5] block: plumb up open-hook-fd option Stefan Hajnoczi
2012-05-01 15:31 ` [Qemu-devel] [RFC 4/5] osdep: add qemu_recvmsg() wrapper Stefan Hajnoczi
2012-05-01 15:31 ` [Qemu-devel] [RFC 5/5] Example -open-hook-fd server Stefan Hajnoczi
2012-05-01 16:04   ` [Qemu-devel] [libvirt] " Stefan Hajnoczi
2012-05-01 20:25 ` [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd Anthony Liguori
2012-05-01 20:56   ` [Qemu-devel] [libvirt] " Eric Blake
2012-05-01 21:52     ` Anthony Liguori
2012-05-02 16:40     ` Paolo Bonzini
2012-05-01 21:45   ` [Qemu-devel] " Corey Bryant
2012-05-01 21:53     ` Anthony Liguori
2012-05-01 22:15       ` Eric Blake [this message]
2012-05-01 22:21         ` [Qemu-devel] [libvirt] " Anthony Liguori
2012-05-07 16:10         ` Corey Bryant
2012-05-02  8:20   ` [Qemu-devel] " Kevin Wolf
2012-05-02  8:27     ` Stefan Hajnoczi
2012-05-02  9:38       ` Kevin Wolf
2012-05-02  8:53     ` [Qemu-devel] [libvirt] " Daniel P. Berrange
2012-05-02  9:45       ` Kevin Wolf
2012-05-02  9:56         ` Daniel P. Berrange
2012-05-02 19:25           ` Paolo Bonzini
2012-05-03 19:19         ` Anthony Liguori
2012-05-02  9:01 ` [Qemu-devel] " Daniel P. Berrange
2012-05-04  3:28 ` [Qemu-devel] [libvirt] " Zhi Yong Wu
2012-05-17 13:42   ` Stefan Hajnoczi
2012-05-17 13:57     ` Zhi Yong Wu
2012-05-17 14:02     ` Zhi Yong Wu
2012-05-18 10:38       ` Stefan Hajnoczi
2012-05-17 14:14     ` Eric Blake
2012-05-18 10:38       ` Stefan Hajnoczi
2012-07-09 20:00       ` Anthony Liguori
2012-07-09 20:29         ` Eric Blake
2012-07-09 20:46           ` Anthony Liguori

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=4FA0608A.7070800@redhat.com \
    --to=eblake@redhat.com \
    --cc=aliguori@us.ibm.com \
    --cc=anthony@codemonkey.ws \
    --cc=coreyb@linux.vnet.ibm.com \
    --cc=kwolf@redhat.com \
    --cc=libvir-list@redhat.com \
    --cc=qemu-devel@nongnu.org \
    --cc=stefanha@linux.vnet.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.