From: Anthony Liguori <anthony@codemonkey.ws>
To: "Michael S. Tsirkin" <mst@redhat.com>
Cc: Arnd Bergmann <arnd@arndb.de>, Sridhar Samudrala <sri@us.ibm.com>,
avi@redhat.com, markmc@redhat.com, ogerlitz@voltaire.com,
kvm@vger.kernel.org, qemu-devel@vger.kernel.org,
Chris Wright <chrisw@redhat.com>
Subject: Re: [PATCH qemu-kvm] Add raw(af_packet) network backend to qemu
Date: Thu, 28 Jan 2010 11:58:48 -0600 [thread overview]
Message-ID: <4B61D058.20606@codemonkey.ws> (raw)
In-Reply-To: <20100128163720.GB3288@redhat.com>
On 01/28/2010 10:37 AM, Michael S. Tsirkin wrote:
> So actually, this is an interesting argument in favor of
> turning disablenetwork from per-process as it is now
> to per-file.
>
Yup. I think we really need a file-based restriction mechanism and so
far, neither disablenetwork or network namespace seems to do that.
I think you might be able to mitigate this with SELinux since I'm fairly
certain it can prevent SCM_RIGHTS but SELinux is not something that can
be enforced within a set of applications so we'd be relying on SELinux
being enabled (honestly, unlikely) and the policy being correctly
configured (unlikely in the general case at least).
Regards,
Anthony Liguori
>
>> Regards,
>>
>> Anthony Liguori
>>
>>
>>>> Regards,
>>>>
>>>> Anthony Liguori
>>>>
>>>>
next prev parent reply other threads:[~2010-01-28 17:59 UTC|newest]
Thread overview: 41+ messages / expand[flat|nested] mbox.gz Atom feed top
2010-01-26 20:40 [PATCH qemu-kvm] Add raw(af_packet) network backend to qemu Sridhar Samudrala
2010-01-26 20:47 ` Anthony Liguori
2010-01-26 20:50 ` Anthony Liguori
2010-01-26 23:19 ` Sridhar Samudrala
2010-01-27 9:24 ` Michael S. Tsirkin
2010-01-27 9:34 ` Arnd Bergmann
2010-01-27 9:44 ` Michael S. Tsirkin
2010-01-27 14:03 ` Anthony Liguori
2010-01-27 21:39 ` Arnd Bergmann
2010-01-27 22:56 ` Sridhar Samudrala
2010-01-28 6:06 ` Arnd Bergmann
2010-01-28 16:53 ` Jens Osterkamp
2010-01-28 11:22 ` Or Gerlitz
2010-01-29 20:52 ` Sridhar Samudrala
2010-01-27 14:07 ` Anthony Liguori
2010-01-27 16:59 ` Michael S. Tsirkin
2010-01-27 17:07 ` Anthony Liguori
2010-01-27 17:25 ` Michael S. Tsirkin
2010-01-27 17:36 ` Anthony Liguori
2010-01-27 17:54 ` Sridhar Samudrala
2010-01-27 18:02 ` Anthony Liguori
2010-01-27 18:03 ` Michael S. Tsirkin
2010-01-27 19:54 ` Anthony Liguori
2010-01-28 8:12 ` Arnd Bergmann
2010-01-28 13:56 ` Michael S. Tsirkin
2010-01-28 14:13 ` Anthony Liguori
2010-01-28 14:39 ` Anthony Liguori
2010-01-28 14:52 ` Michael S. Tsirkin
2010-01-28 15:05 ` Anthony Liguori
2010-01-28 16:37 ` Michael S. Tsirkin
2010-01-28 17:58 ` Anthony Liguori [this message]
2010-01-28 18:04 ` Michael S. Tsirkin
2010-01-28 19:57 ` Anthony Liguori
2010-01-29 11:26 ` Michael S. Tsirkin
2010-01-28 20:29 ` Arnd Bergmann
2010-02-01 15:47 ` Or Gerlitz
2010-01-27 18:12 ` Michael S. Tsirkin
2010-01-26 23:15 ` Sridhar Samudrala
2010-01-27 0:06 ` [Qemu-devel] " Anthony Liguori
2010-01-27 6:52 ` Arnd Bergmann
2010-01-27 14:14 ` Anthony Liguori
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=4B61D058.20606@codemonkey.ws \
--to=anthony@codemonkey.ws \
--cc=arnd@arndb.de \
--cc=avi@redhat.com \
--cc=chrisw@redhat.com \
--cc=kvm@vger.kernel.org \
--cc=markmc@redhat.com \
--cc=mst@redhat.com \
--cc=ogerlitz@voltaire.com \
--cc=qemu-devel@vger.kernel.org \
--cc=sri@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox