From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:33091) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QliD6-0002bY-IR for qemu-devel@nongnu.org; Tue, 26 Jul 2011 10:02:14 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QliD5-00079c-II for qemu-devel@nongnu.org; Tue, 26 Jul 2011 10:02:12 -0400 Received: from mx1.redhat.com ([209.132.183.28]:30130) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QliD5-00079W-BI for qemu-devel@nongnu.org; Tue, 26 Jul 2011 10:02:11 -0400 Message-ID: <4E2EC8DA.4090303@redhat.com> Date: Tue, 26 Jul 2011 08:02:02 -0600 From: Eric Blake MIME-Version: 1.0 References: <1311684710-27074-1-git-send-email-coreyb@linux.vnet.ibm.com> <20110726130211.GA2853@lst.de> In-Reply-To: <20110726130211.GA2853@lst.de> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [libvirt] [PATCH v3] Add support for fd: protocol List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Christoph Hellwig Cc: kwolf@redhat.com, aliguori@us.ibm.com, libvir-list@redhat.com, Corey Bryant , qemu-devel@nongnu.org, tchicks@us.ibm.com On 07/26/2011 07:02 AM, Christoph Hellwig wrote: > I have to say I really hate it. We've been working hard on getting rid > of special cases in the qemu block layer, and this sprinkles them all > over. I'd recommend to fix your security model instead. What is it that you hate - the particular qemu implementation expressed by this patch (in which case, we're all ears for a better implementation), or the need for fd passing (which libvirt is strongly in favor of, and which there really is no other way to fix the security model to work well with file systems like NFS that lack per-file labels)? In my mind, increased security trumps poor aesthetics - if the patch really does make it possible to enhance security, then the special casing to support the patch is worth it. -- Eric Blake eblake@redhat.com +1-801-349-2682 Libvirt virtualization library http://libvirt.org