Re: [PATCH RFC] qga: Add selinux-helper for guest-exec subcommand (bsc#1237450)

["Daniel P. Berrangé" <berrange@redhat.com>]

On Tue, Apr 14, 2026 at 07:13:14PM +0200, Martin Wilck wrote:
> On Tue, 2026-04-14 at 18:00 +0100, Daniel P. Berrangé wrote:
> > On Tue, Apr 14, 2026 at 06:51:12PM +0200, Martin Wilck wrote:
> > 
> > 
> > > > If users want to support an ability to have arbitrary command
> > > > execution, then that should be done with SSH over VSock, where
> > > > the guest owner can choose whether to require authentication
> > > > first or not, and use SSH authorized_keys if desired to limit
> > > > what commands can be run for a given recorded key.
> > > > 
> > > > These days systemd installs magic to allow SSH'ing directly
> > > > to a guest using VSOCK addresses, and libvirt further
> > > > enhances that to allow SSH'ing to a named VM.
> > > 
> > > Thanks, I wasn't aware of this feature so far. I suppose you're
> > > referring to https://libvirt.org/ssh-proxy.html. I'll need to
> > > experiment with it. IIUC this works for local libvirt connections
> > > only?
> > 
> > Yes, vsock is exposed to the local host.
> 
> And it can't / won't be implemented for remote hosts?

That doesn't make sense conceptually. Think of VSOCK as the equivalent
of a UNIX domain socket, but between host & guest.  If you want off
node access, then IP sockets are what you want, either directly from
the guest, or tunnelled to VSOCK via the host.

With regards,
Daniel
-- 
|: https://berrange.com       ~~        https://hachyderm.io/@berrange :|
|: https://libvirt.org          ~~          https://entangle-photo.org :|
|: https://pixelfed.art/berrange   ~~    https://fstop138.berrange.com :|