Re: [RFC][PATCH 00/01]qemu VM entrypoints

Avi Kivity
2007-07-21T06:21:29Z

Anthony Liguori wrote:
> James Morris wrote:
>
>> On Fri, 20 Jul 2007, Daniel P. Berrange wrote:
>>
>>
>>
>>> It could be - if your put the policy at the control API layer instead of
>>> in QEMU itself.
>>>
>>>
>> Then you can bypass MAC security by invoking qemu directly.
>>
>>
>
> You can bypass MAC security by writing your own binary that uses the KVM
> kernel interfaces.
>
>

I guess modifying qemu makes sense if the modification gives you *more*
permissions.

i.e. you start out just with the ability to access the disk image, and
then you transition to a new domain that allows you to access some network.

Is that what is intended here?

--
Do not meddle in the internals of kernels, for they are subtle and quick to panic.