public inbox for kvm@vger.kernel.org
 help / color / mirror / Atom feed
From: Avi Kivity <avi-atKUWr5tajBWk0Htik3J/w@public.gmane.org>
To: Anthony Liguori <anthony-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
Cc: kvm-devel
	<kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org>,
	David Windsor <dwindsor-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org>,
	Joshua Brindle <jbrindle-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org>,
	selinux <selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org>
Subject: Re: [RFC][PATCH 00/01]qemu VM entrypoints
Date: Sat, 21 Jul 2007 09:21:29 +0300	[thread overview]
Message-ID: <46A1A5E9.7000807@qumranet.com> (raw)
In-Reply-To: <46A11F1A.2080004-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>

Anthony Liguori wrote:
> James Morris wrote:
>   
>> On Fri, 20 Jul 2007, Daniel P. Berrange wrote:
>>
>>   
>>     
>>> It could be - if your put the policy at the control API layer instead of
>>> in QEMU itself.
>>>     
>>>       
>> Then you can bypass MAC security by invoking qemu directly.
>>   
>>     
>
> You can bypass MAC security by writing your own binary that uses the KVM 
> kernel interfaces.
>
>   

I guess modifying qemu makes sense if the modification gives you *more*
permissions.

i.e. you start out just with the ability to access the disk image, and
then you transition to a new domain that allows you to access some network.


Is that what is intended here?

-- 
Do not meddle in the internals of kernels, for they are subtle and quick to panic.


-------------------------------------------------------------------------
This SF.net email is sponsored by: Microsoft
Defy all challenges. Microsoft(R) Visual Studio 2005.
http://clk.atdmt.com/MRT/go/vse0120000070mrt/direct/01/

  parent reply	other threads:[~2007-07-21  6:21 UTC|newest]

Thread overview: 24+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2007-07-20 19:32 [RFC][PATCH 00/01]qemu VM entrypoints David Windsor
     [not found] ` <C2C68600.366D%dwindsor-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org>
2007-07-20 20:03   ` Anthony Liguori
     [not found]     ` <46A1151F.7020502-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-20 21:55       ` David Windsor
2007-07-20 22:19         ` [kvm-devel] " Anthony Liguori
2007-07-20 20:11   ` Daniel P. Berrange
     [not found]     ` <20070720201101.GC12218-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2007-07-20 20:30       ` James Morris
2007-07-20 20:38         ` Daniel P. Berrange
2007-07-20 20:46         ` Anthony Liguori
     [not found]           ` <46A11F1A.2080004-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-20 22:42             ` James Morris
2007-07-20 22:53               ` Anthony Liguori
     [not found]                 ` <46A13CDB.7020900-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-20 23:33                   ` James Morris
2007-07-21  2:48               ` David Windsor
2007-07-21  6:21             ` Avi Kivity [this message]
     [not found]               ` <46A1A5E9.7000807-atKUWr5tajBWk0Htik3J/w@public.gmane.org>
2007-07-21  6:53                 ` David Windsor
     [not found]                   ` <C2C7258F.36C9%dwindsor-Re5JQEeQqe8AvxtiuMwx3w@public.gmane.org>
2007-07-21 15:54                     ` Anthony Liguori
     [not found]                       ` <46A22C37.5030004-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-21 17:55                         ` James Morris
2007-07-21 19:01                           ` Joshua Brindle
     [not found]                             ` <6FE441CD9F0C0C479F2D88F959B01588DE1B1E-Lp/cVzEoVybUo1n7N8X6UhN0Am9MfdqnVpNB7YpNyf8@public.gmane.org>
2007-07-22 19:07                               ` Anthony Liguori
     [not found]                                 ` <46A3AB09.3090800-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org>
2007-07-22 20:22                                   ` David Windsor
2007-07-22 17:39                         ` David Windsor
2007-07-20 21:57         ` David Windsor
     [not found]           ` <25a1d91b0707201457m6865a505maf93d22c5c28f0cc-JsoAwUIsXosN+BqQ9rBEUg@public.gmane.org>
2007-07-20 23:50             ` Daniel P. Berrange
     [not found]               ` <20070720235007.GA1595-H+wXaHxf7aLQT0dZR+AlfA@public.gmane.org>
2007-07-21  1:41                 ` James Morris
2007-07-20 20:35   ` James Morris

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=46A1A5E9.7000807@qumranet.com \
    --to=avi-atkuwr5tajbwk0htik3j/w@public.gmane.org \
    --cc=anthony-rdkfGonbjUSkNkDKm+mE6A@public.gmane.org \
    --cc=dwindsor-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org \
    --cc=jbrindle-5TQdPaFcblfQT0dZR+AlfA@public.gmane.org \
    --cc=kvm-devel-5NWGOfrQmneRv+LV9MX5uipxlwaOVQ5f@public.gmane.org \
    --cc=selinux-+05T5uksL2qpZYMLLGbcSA@public.gmane.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox