All of lore.kernel.org
 help / color / mirror / Atom feed
From: Blue Swirl <blauwirbel@gmail.com>
To: Corey Bryant <bryntcor@us.ibm.com>
Cc: aliguori@us.ibm.com, qemu-devel@nongnu.org,
	Tyler C Hicks <tchicks@us.ibm.com>
Subject: Re: [Qemu-devel] [PATCH] Add support for fd: protocol
Date: Fri, 20 May 2011 22:25:55 +0300	[thread overview]
Message-ID: <BANLkTi=xZMTfvcbhZ2MdmJoFmot--bU2Fg@mail.gmail.com> (raw)
In-Reply-To: <4DD6B777.9020800@us.ibm.com>

On Fri, May 20, 2011 at 9:48 PM, Corey Bryant <bryntcor@us.ibm.com> wrote:
> sVirt provides SELinux MAC isolation for Qemu guest processes and their
> corresponding resources (image files). sVirt provides this support
> by labeling guests and resources with security labels that are stored
> in file system extended attributes. Some file systems, such as NFS, do
> not support the extended attribute security namespace, which is needed
> for image file isolation when using the sVirt SELinux security driver
> in libvirt.
>
> The proposed solution entails a combination of Qemu, libvirt, and
> SELinux patches that work together to isolate multiple guests' images
> when they're stored in the same NFS mount. This results in an
> environment where sVirt isolation and NFS image file isolation can both
> be provided.

Very nice. QEMU should use this to support privilege separation. We
already have chroot and runas switches, a new switch should convert
all file references to fd references internally for that process. If
this can be made transparent, this should even be the default way of
operation.

  parent reply	other threads:[~2011-05-20 19:26 UTC|newest]

Thread overview: 26+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2011-05-20 18:48 [Qemu-devel] [PATCH] Add support for fd: protocol Corey Bryant
2011-05-20 19:05 ` Anthony Liguori
2011-05-20 19:25 ` Blue Swirl [this message]
2011-05-20 19:42   ` Anthony Liguori
2011-05-20 19:53     ` Blue Swirl
2011-05-23 14:28       ` Kevin Wolf
2011-05-23 15:24         ` Markus Armbruster
2011-05-23 15:56           ` Kevin Wolf
2011-05-23 19:50             ` Blue Swirl
2011-05-23 21:55             ` Anthony Liguori
2011-05-23 18:20           ` Corey Bryant
2011-05-23  9:45 ` Daniel P. Berrange
2011-05-23 10:19   ` Stefan Hajnoczi
2011-05-23 10:30     ` Daniel P. Berrange
2011-05-23 12:59       ` Anthony Liguori
2011-05-23 14:35         ` Markus Armbruster
2011-05-23 22:49           ` Jamie Lokier
2011-05-24  8:39             ` Stefan Hajnoczi
2011-05-24 15:31               ` Jamie Lokier
2011-05-23 12:50   ` Anthony Liguori
2011-05-23 13:06     ` Daniel P. Berrange
2011-05-23 13:09     ` Stefan Hajnoczi
2011-05-23 13:21       ` Anthony Liguori
2011-05-23 13:26         ` Stefan Hajnoczi
2011-05-23 13:42           ` Daniel P. Berrange
2011-05-23  9:48 ` Daniel P. Berrange

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to='BANLkTi=xZMTfvcbhZ2MdmJoFmot--bU2Fg@mail.gmail.com' \
    --to=blauwirbel@gmail.com \
    --cc=aliguori@us.ibm.com \
    --cc=bryntcor@us.ibm.com \
    --cc=qemu-devel@nongnu.org \
    --cc=tchicks@us.ibm.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.