From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:42709) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SzsY2-0004HS-62 for qemu-devel@nongnu.org; Fri, 10 Aug 2012 12:58:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SzsY0-0002t3-Me for qemu-devel@nongnu.org; Fri, 10 Aug 2012 12:58:54 -0400 Received: from e31.co.us.ibm.com ([32.97.110.149]:44441) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SzsY0-0002ss-FF for qemu-devel@nongnu.org; Fri, 10 Aug 2012 12:58:52 -0400 Received: from /spool/local by e31.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 10 Aug 2012 10:58:51 -0600 Received: from d03relay02.boulder.ibm.com (d03relay02.boulder.ibm.com [9.17.195.227]) by d03dlp02.boulder.ibm.com (Postfix) with ESMTP id B499D3E4003B for ; Fri, 10 Aug 2012 16:58:35 +0000 (WET) Received: from d03av03.boulder.ibm.com (d03av03.boulder.ibm.com [9.17.195.169]) by d03relay02.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q7AGw4k6076002 for ; Fri, 10 Aug 2012 10:58:21 -0600 Received: from d03av03.boulder.ibm.com (loopback [127.0.0.1]) by d03av03.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q7AGvlfi030323 for ; Fri, 10 Aug 2012 10:57:48 -0600 Message-ID: <50253D89.4090707@linux.vnet.ibm.com> Date: Fri, 10 Aug 2012 12:57:45 -0400 From: Corey Bryant MIME-Version: 1.0 References: <1344564649-6272-1-git-send-email-coreyb@linux.vnet.ibm.com> <50253888.7070100@redhat.com> In-Reply-To: <50253888.7070100@redhat.com> Content-Type: text/plain; charset=ISO-8859-15; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v8 0/7] file descriptor passing using fd sets List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Kevin Wolf Cc: aliguori@us.ibm.com, stefanha@linux.vnet.ibm.com, libvir-list@redhat.com, qemu-devel@nongnu.org, lcapitulino@redhat.com, pbonzini@redhat.com, eblake@redhat.com On 08/10/2012 12:36 PM, Kevin Wolf wrote: > Am 10.08.2012 04:10, schrieb Corey Bryant: >> libvirt's sVirt security driver provides SELinux MAC isolation for >> Qemu guest processes and their corresponding image files. In other >> words, sVirt uses SELinux to prevent a QEMU process from opening >> files that do not belong to it. >> >> sVirt provides this support by labeling guests and resources with >> security labels that are stored in file system extended attributes. >> Some file systems, such as NFS, do not support the extended >> attribute security namespace, and therefore cannot support sVirt >> isolation. >> >> A solution to this problem is to provide fd passing support, where >> libvirt opens files and passes file descriptors to QEMU. This, >> along with SELinux policy to prevent QEMU from opening files, can >> provide image file isolation for NFS files stored on the same NFS >> mount. >> >> This patch series adds the add-fd, remove-fd, and query-fdsets >> QMP monitor commands, which allow file descriptors to be passed >> via SCM_RIGHTS, and assigned to specified fd sets. This allows >> fd sets to be created per file with fds having, for example, >> different access rights. When QEMU needs to reopen a file with >> different access rights, it can search for a matching fd in the >> fd set. Fd sets also allow for easy tracking of fds per file, >> helping to prevent fd leaks. >> >> Support is also added to the block layer to allow QEMU to dup an >> fd from an fdset when the filename is of the /dev/fdset/nnn format, >> where nnn is the fd set ID. >> >> No new SELinux policy is required to prevent open of NFS files >> (files with type nfs_t). The virt_use_nfs boolean type simply >> needs to be set to false, and open will be prevented (and dup will >> be allowed). For example: >> >> # setsebool virt_use_nfs 0 >> # getsebool virt_use_nfs >> virt_use_nfs --> off >> >> Corey Bryant (7): >> qemu-char: Add MSG_CMSG_CLOEXEC flag to recvmsg >> qapi: Introduce add-fd, remove-fd, query-fdsets >> monitor: Clean up fd sets on monitor disconnect >> block: Prevent detection of /dev/fdset/ as floppy >> block: Convert open calls to qemu_open >> block: Convert close calls to qemu_close >> block: Enable qemu_open/close to work with fd sets >> >> block/raw-posix.c | 46 +++++---- >> block/raw-win32.c | 6 +- >> block/vdi.c | 5 +- >> block/vmdk.c | 25 ++--- >> block/vpc.c | 4 +- >> block/vvfat.c | 16 +-- >> cutils.c | 5 + >> monitor.c | 294 +++++++++++++++++++++++++++++++++++++++++++++++++++++ >> monitor.h | 5 + >> osdep.c | 117 +++++++++++++++++++++ >> qapi-schema.json | 98 ++++++++++++++++++ >> qemu-char.c | 12 ++- >> qemu-common.h | 2 + >> qemu-tool.c | 20 ++++ >> qmp-commands.hx | 117 +++++++++++++++++++++ >> savevm.c | 4 +- >> 16 files changed, 721 insertions(+), 55 deletions(-) > > Apart from the few comments I made, I like this series. Maybe v9 will be > the last one. :-) Thanks, I hope so too! -- Regards, Corey