From mboxrd@z Thu Jan 1 00:00:00 1970 From: Anthony Liguori Subject: Re: [PATCH qemu-kvm] Add raw(af_packet) network backend to qemu Date: Thu, 28 Jan 2010 11:58:48 -0600 Message-ID: <4B61D058.20606@codemonkey.ws> References: <4B5F54E8.3080507@codemonkey.ws> <20100127180338.GB13730@redhat.com> <4B6099E0.40101@codemonkey.ws> <201001280912.04809.arnd@arndb.de> <20100128135644.GE3776@redhat.com> <4B619BA1.9010404@codemonkey.ws> <20100128145226.GA10497@redhat.com> <4B61A7C9.7040808@codemonkey.ws> <20100128163720.GB3288@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Cc: Arnd Bergmann , Sridhar Samudrala , avi@redhat.com, markmc@redhat.com, ogerlitz@voltaire.com, kvm@vger.kernel.org, qemu-devel@vger.kernel.org, Chris Wright To: "Michael S. Tsirkin" Return-path: Received: from mail-qy0-f182.google.com ([209.85.221.182]:47128 "EHLO mail-qy0-f182.google.com" rhost-flags-OK-OK-OK-OK) by vger.kernel.org with ESMTP id S1753665Ab0A1R7D (ORCPT ); Thu, 28 Jan 2010 12:59:03 -0500 In-Reply-To: <20100128163720.GB3288@redhat.com> Sender: kvm-owner@vger.kernel.org List-ID: On 01/28/2010 10:37 AM, Michael S. Tsirkin wrote: > So actually, this is an interesting argument in favor of > turning disablenetwork from per-process as it is now > to per-file. > Yup. I think we really need a file-based restriction mechanism and so far, neither disablenetwork or network namespace seems to do that. I think you might be able to mitigate this with SELinux since I'm fairly certain it can prevent SCM_RIGHTS but SELinux is not something that can be enforced within a set of applications so we'd be relying on SELinux being enabled (honestly, unlikely) and the policy being correctly configured (unlikely in the general case at least). Regards, Anthony Liguori > >> Regards, >> >> Anthony Liguori >> >> >>>> Regards, >>>> >>>> Anthony Liguori >>>> >>>>