From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from mailman by lists.gnu.org with tmda-scanned (Exim 4.33) id 1BazuF-0004mU-8U for qemu-devel@nongnu.org; Thu, 17 Jun 2004 12:38:27 -0400 Received: from exim by lists.gnu.org with spam-scanned (Exim 4.33) id 1BazuD-0004m9-ES for qemu-devel@nongnu.org; Thu, 17 Jun 2004 12:38:26 -0400 Received: from [199.232.76.173] (helo=monty-python.gnu.org) by lists.gnu.org with esmtp (Exim 4.33) id 1BazuD-0004lz-98 for qemu-devel@nongnu.org; Thu, 17 Jun 2004 12:38:25 -0400 Received: from [206.72.67.39] (helo=claudius.sentinelchicken.org) by monty-python.gnu.org with smtp (Exim 4.34) id 1Bazsa-0000Pk-Gq for qemu-devel@nongnu.org; Thu, 17 Jun 2004 12:36:44 -0400 Date: Thu, 17 Jun 2004 09:37:40 -0700 From: Tim Subject: Re: [Qemu-devel] [PATCH] Security house-cleaning Message-ID: <20040617163740.GB20148@sentinelchicken.org> References: <20040617043838.GA1938@sentinelchicken.org> <1087484840.21569.108.camel@sherbert> <20040617151418.GD27872@cs.unibo.it> Mime-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20040617151418.GD27872@cs.unibo.it> Reply-To: qemu-devel@nongnu.org List-Id: qemu-devel.nongnu.org List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org > One of the main pros of Qemu (among the others) it that it has been > designed NOT to run SUID. > The only piece of code that need root access is tuntap networking. > This problem can be circunvented by: > - using sudo for tuntap > - using user net (a.k.a slirp) > - using vde. Other future considerations: - PCI Proxy support (if it is ever offically supported) How will the host OS allow access by QEMU guest in this case? - Other bus (USB, firewire, etc) direct access to real hardware Not trying to be alarmist. Just being conservative with code quality/security. tim