From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:36338) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SPFDb-0004X6-3L for qemu-devel@nongnu.org; Tue, 01 May 2012 11:42:24 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SPFDZ-0004Jx-9M for qemu-devel@nongnu.org; Tue, 01 May 2012 11:42:22 -0400 Received: from e06smtp14.uk.ibm.com ([195.75.94.110]:42145) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SPFDZ-0004JL-0V for qemu-devel@nongnu.org; Tue, 01 May 2012 11:42:21 -0400 Received: from /spool/local by e06smtp14.uk.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 1 May 2012 16:32:02 +0100 Received: from d06av05.portsmouth.uk.ibm.com (d06av05.portsmouth.uk.ibm.com [9.149.37.229]) by d06nrmr1806.portsmouth.uk.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q41FVxVw2908362 for ; Tue, 1 May 2012 16:31:59 +0100 Received: from d06av05.portsmouth.uk.ibm.com (loopback [127.0.0.1]) by d06av05.portsmouth.uk.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q41FVxfs032674 for ; Tue, 1 May 2012 09:31:59 -0600 From: Stefan Hajnoczi Date: Tue, 1 May 2012 16:31:42 +0100 Message-Id: <1335886307-27586-1-git-send-email-stefanha@linux.vnet.ibm.com> Subject: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Kevin Wolf , Anthony Liguori , Stefan Hajnoczi , libvir-list@redhat.com, Corey Bryant Libvirt can take advantage of SELinux to restrict the QEMU process and prevent it from opening files that it should not have access to. This improves security because it prevents the attacker from escaping the QEMU process if they manage to gain control. NFS has been a pain point for SELinux because it does not support labels (which I believe are stored in extended attributes). In other words, it's not possible to use SELinux goodness on QEMU when image files are located on NFS. Today we have to allow QEMU access to any file on the NFS export rather than restricting specifically to the image files that the guest requires. File descriptor passing is a solution to this problem and might also come in handy elsewhere. Libvirt or another external process chooses files which QEMU is allowed to access and provides just those file descriptors - QEMU cannot open the files itself. This series adds the -open-hook-fd command-line option. Whenever QEMU needs to open an image file it sends a request over the given UNIX domain socket. The response includes the file descriptor or an errno on failure. Please see the patches for details on the protocol. The -open-hook-fd approach allows QEMU to support file descriptor passing without changing -drive. It also supports snapshot_blkdev and other commands that re-open image files. Anthony Liguori wrote most of these patches. I added a demo -open-hook-fd server and added some small fixes. Since Anthony is traveling right now I'm sending the RFC for discussion. Anthony Liguori (3): block: add open() wrapper that can be hooked by libvirt block: add new command line parameter that and protocol description block: plumb up open-hook-fd option Stefan Hajnoczi (2): osdep: add qemu_recvmsg() wrapper Example -open-hook-fd server block.c | 107 ++++++++++++++++++++++++++++++++++++++ block.h | 2 + block/raw-posix.c | 18 +++---- block/raw-win32.c | 2 +- block/vdi.c | 2 +- block/vmdk.c | 6 +-- block/vpc.c | 2 +- block/vvfat.c | 4 +- block_int.h | 12 +++++ osdep.c | 46 +++++++++++++++++ qemu-common.h | 2 + qemu-options.hx | 42 +++++++++++++++ test-fd-passing.c | 147 +++++++++++++++++++++++++++++++++++++++++++++++++++++ vl.c | 3 ++ 14 files changed, 378 insertions(+), 17 deletions(-) create mode 100644 test-fd-passing.c -- 1.7.10