From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:57754) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SPLMN-0003m0-Eg for qemu-devel@nongnu.org; Tue, 01 May 2012 18:15:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SPLML-0000L1-Ij for qemu-devel@nongnu.org; Tue, 01 May 2012 18:15:51 -0400 Received: from mx1.redhat.com ([209.132.183.28]:55511) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SPLML-0000Kq-9p for qemu-devel@nongnu.org; Tue, 01 May 2012 18:15:49 -0400 Message-ID: <4FA0608A.7070800@redhat.com> Date: Tue, 01 May 2012 16:15:38 -0600 From: Eric Blake MIME-Version: 1.0 References: <1335886307-27586-1-git-send-email-stefanha@linux.vnet.ibm.com> <4FA046C6.5080909@us.ibm.com> <4FA0598E.1040408@linux.vnet.ibm.com> <4FA05B63.3090301@codemonkey.ws> In-Reply-To: <4FA05B63.3090301@codemonkey.ws> Content-Type: multipart/signed; micalg=pgp-sha256; protocol="application/pgp-signature"; boundary="------------enigB4B0B10E9456C18CBFA9DB45" Subject: Re: [Qemu-devel] [libvirt] [RFC 0/5] block: File descriptor passing using -open-hook-fd List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Kevin Wolf , Anthony Liguori , Stefan Hajnoczi , libvir-list@redhat.com, Corey Bryant , qemu-devel@nongnu.org This is an OpenPGP/MIME signed message (RFC 2440 and 3156) --------------enigB4B0B10E9456C18CBFA9DB45 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable On 05/01/2012 03:53 PM, Anthony Liguori wrote: >> I think (correct me if I'm wrong) libvirt should be aware of any file >> that qemu >> asks it to open. So from a security point of view, libvirt can prevent= >> opening a >> file if it isn't affiliated with the guest. >=20 > Right, libvirt can maintain a whitelist of files QEMU is allowed to ope= n > (which is already has because it needs to label these files). Indeed. > The only > complexity is that it's not a straight strcmp(). The path needs to be > (carefully) broken into components with '.' and '..' handled > appropriately. But this shouldn't be that difficult to do. Libvirt would probably canonicalize path names, both when sticking them in the whitelist, and in validating the requests from qemu - agreed that it's not difficult. More importantly, libvirt needs to start tracking the backing chain of any qcow2 or qed file as part of the domain XML; and operations like 'block-stream' would update not only the chain, but also the whitelist. In the drive-reopen case, this means that libvirt would have to be careful when to change labeling - provide access to the new files before drive-reopen, then revoke access to files after drive-reopen completes. In other words, having the -open-hook-fd client pass a command to libvirt at the time it is closing an fd would help libvirt know when qemu has quit using a file, which might make it easier to revoke SELinux labels at that time. --=20 Eric Blake eblake@redhat.com +1-919-301-3266 Libvirt virtualization library http://libvirt.org --------------enigB4B0B10E9456C18CBFA9DB45 Content-Type: application/pgp-signature; name="signature.asc" Content-Description: OpenPGP digital signature Content-Disposition: attachment; filename="signature.asc" -----BEGIN PGP SIGNATURE----- Version: GnuPG v1.4.12 (GNU/Linux) Comment: Public key at http://people.redhat.com/eblake/eblake.gpg Comment: Using GnuPG with Mozilla - http://enigmail.mozdev.org/ iQEcBAEBCAAGBQJPoGCKAAoJEKeha0olJ0NqMBIH/jkOvEsHpKtgtQopToCYyLN0 niU7WK/UXAR2OUKkaA4kQHzG/3COl8R7seUKP+nrIR3/ILQTJ6EejGVpNWoypV57 w6q3ShWmCu6T84QDuFry+Sps2/pthwfhzlii/ihbawkWb4oTIWYeOnQDnKQ7JWha r0xRJmuYwUsTWQezXCHGHIuFTXmtJBh2QyM32/OK6K+UKwNk1jImKoG6jacNukvr EQ8MpGJFQAy/1gMEIAUhuAaxOG+n6kj7mOyczXThBZKnHPr0+Aq4AiF+OCIlDQ/S OzESxpl3SY8XkNwbGlxqI5yl2Py2HqnUESWrw/7IEK7xKg3ZVnvZvZ+/M4FpR6E= =2s0R -----END PGP SIGNATURE----- --------------enigB4B0B10E9456C18CBFA9DB45--