Re: [Qemu-devel] [PATCH 0/4] net-bridge: rootless bridge support for qemu

[Anthony Liguori <anthony@codemonkey.ws>]

Jamie Lokier wrote:
> Anthony Liguori wrote:
>   
>> At least with KVM support, this is probably the most common use case
>> which means that most of our users are running qemu as root.  That's
>> terrible.
>>     
>
> I've been using KVM for a year or so with bridged networking,
> without needing to run it as root.
>
> So there's obviously been some bad advice floating around :-)
>
> What I do is have tun interfaces owned by the user...
>   

I mention this in one of my patches.  The problem with persistent tun 
devices is that every time a user needs to create a guest, an 
adminstrator action is needed.  That doesn't extend well to a system 
that Just Works.

>> We address this problem by introducing a new network backend: -net bridge.  This
>> backend is less flexible than -net tap because it relies on a helper with
>> elevated privileges to do the heavy lifting of allocating and attaching a tap
>> device to a bridge.  We use a special purpose helper because we don't want
>> to elevate the privileges of more generic tools like brctl.
>>     
>
> I think it's a great idea.
>
> It would be even more useful if the "bridge setup" and "bridge
> teardown" helper commands could be specified as qemu options, and
> eventually as config file entries, in the same way as script= and
> downscript= are already.
>   

The problem with this is that the helper runs with increased 
capabilities but as a lesser user.  Various networking commands don't 
necessarily behave well when run like this.  But more importantly, you 
would have to run the helper with inheritable privileges which is a 
bigger security risk than what we do at the moment.

There's only one way to add a device to a bridge so I'm not sure it's 
really necessary either.

> That way it would be useful for all sorts of network configurations
> where a user-allocatable tap+bridge interface is needed.
>
> You can do it now by wrapping _around_ qemu using the -net tap,fd=N
> option, but calling a helper to get assigned a tap interface is much neater.
>
> By the way, would it make sense for the helper to return an open file
> descriptor rather than an interface name, just like -net tap,fd=N
> uses?  Or does qemu need to access the interface by name anyway?
>   

The helper does return an fd.  The internal implementation is pretty 
much -net tap,fd=N.  You can point it to a different helper if you'd 
like by saying -net bridge,helper=my-helper.

That said, the helper has to have greater privileges than qemu itself so 
it's something that needs to be very carefully implemented/designed.  I 
don't think it's something you want normal users mucking around with.

Regards,

Anthony Liguori