From: "Daniel P. Berrange" <berrange-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
To: James Morris <jmorris-gx6/JNMH7DfYtjvyW6yDsg@public.gmane.org>
Cc: kvm-devel
<kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>,
David Windsor <dwindsor-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org>,
Joshua Brindle <jbrindle-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org>,
selinux <selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org>
Subject: Re: [RFC][PATCH 00/01]qemu VM entrypoints
Date: Fri, 20 Jul 2007 21:38:42 +0100 [thread overview]
Message-ID: <20070720203842.GE12218@redhat.com> (raw)
In-Reply-To: <Line.LNX.4.64.0707201628150.9702@d.namei>
On Fri, Jul 20, 2007 at 04:30:22PM -0400, James Morris wrote:
> On Fri, 20 Jul 2007, Daniel P. Berrange wrote:
>
> > It could be - if your put the policy at the control API layer instead of
> > in QEMU itself.
>
> Then you can bypass MAC security by invoking qemu directly.
Isn't that upto the policy - if its a targetted policy, then this is true
of most apps where the local users can bypass MAC, since they're all in
unconfined domains. I would have thought strict policy would prevent direct
execution of qemu though ?
Regards,
Dan.
--
|=- Red Hat, Engineering, Emerging Technologies, Boston. +1 978 392 2496 -=|
|=- Perl modules: http://search.cpan.org/~danberr/ -=|
|=- Projects: http://freshmeat.net/~danielpb/ -=|
|=- GnuPG: 7D3B9505 F3C9 553F A1DA 4AC2 5648 23C1 B3DF F742 7D3B 9505 -=|
-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/
next prev parent reply other threads:[~2007-07-20 20:38 UTC|newest]
Thread overview: 24+ messages / expand[flat|nested] mbox.gz Atom feed top
2007-07-20 19:32 [RFC][PATCH 00/01]qemu VM entrypoints David Windsor
[not found] ` <C2C68600.366D%dwindsor-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org>
2007-07-20 20:03 ` Anthony Liguori
[not found] ` <46A1151F.7020502-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-20 21:55 ` David Windsor
2007-07-20 22:19 ` [kvm-devel] " Anthony Liguori
2007-07-20 20:11 ` Daniel P. Berrange
[not found] ` <20070720201101.GC12218-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2007-07-20 20:30 ` James Morris
2007-07-20 20:38 ` Daniel P. Berrange [this message]
2007-07-20 20:46 ` Anthony Liguori
[not found] ` <46A11F1A.2080004-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-20 22:42 ` James Morris
2007-07-20 22:53 ` Anthony Liguori
[not found] ` <46A13CDB.7020900-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-20 23:33 ` James Morris
2007-07-21 2:48 ` David Windsor
2007-07-21 6:21 ` Avi Kivity
[not found] ` <46A1A5E9.7000807-atKUWr5tajBWk0Htik3J/w@public.gmane.org>
2007-07-21 6:53 ` David Windsor
[not found] ` <C2C7258F.36C9%dwindsor-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2007-07-21 15:54 ` Anthony Liguori
[not found] ` <46A22C37.5030004-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-21 17:55 ` James Morris
2007-07-21 19:01 ` Joshua Brindle
[not found] ` <6FE441CD9F0C0C479F2D88F959B01588DE1B1E-Lp/cVzEoVybUo1n7N8X6UhN0Am9MfdqnVpNB7YpNyf8@public.gmane.org>
2007-07-22 19:07 ` Anthony Liguori
[not found] ` <46A3AB09.3090800-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-22 20:22 ` David Windsor
2007-07-22 17:39 ` David Windsor
2007-07-20 21:57 ` David Windsor
[not found] ` <25a1d91b0707201457m6865a505maf93d22c5c28f0cc-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2007-07-20 23:50 ` Daniel P. Berrange
[not found] ` <20070720235007.GA1595-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2007-07-21 1:41 ` James Morris
2007-07-20 20:35 ` James Morris
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20070720203842.GE12218@redhat.com \
--to=berrange-h+wxahxf7alqt0dzr+alfa@public.gmane.org \
--cc=dwindsor-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org \
--cc=jbrindle-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org \
--cc=jmorris-gx6/JNMH7DfYtjvyW6yDsg@public.gmane.org \
--cc=kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org \
--cc=selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox