From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:51925) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SxLgk-0000La-Q7 for qemu-devel@nongnu.org; Fri, 03 Aug 2012 13:29:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SxLgj-0008N5-4H for qemu-devel@nongnu.org; Fri, 03 Aug 2012 13:29:26 -0400 Received: from e35.co.us.ibm.com ([32.97.110.153]:33307) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SxLgi-0008N0-Tf for qemu-devel@nongnu.org; Fri, 03 Aug 2012 13:29:25 -0400 Received: from /spool/local by e35.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 3 Aug 2012 11:29:23 -0600 Received: from d03relay01.boulder.ibm.com (d03relay01.boulder.ibm.com [9.17.195.226]) by d03dlp01.boulder.ibm.com (Postfix) with ESMTP id 35C2C1FF0021 for ; Fri, 3 Aug 2012 17:28:18 +0000 (WET) Received: from d03av05.boulder.ibm.com (d03av05.boulder.ibm.com [9.17.195.85]) by d03relay01.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q73HSH4K077736 for ; Fri, 3 Aug 2012 11:28:18 -0600 Received: from d03av05.boulder.ibm.com (loopback [127.0.0.1]) by d03av05.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q73HSEwp027034 for ; Fri, 3 Aug 2012 11:28:16 -0600 From: Corey Bryant Date: Fri, 3 Aug 2012 13:28:03 -0400 Message-Id: <1344014889-12390-1-git-send-email-coreyb@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH v6 0/6] file descriptor passing using fd sets List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: kwolf@redhat.com, aliguori@us.ibm.com, stefanha@linux.vnet.ibm.com, libvir-list@redhat.com, Corey Bryant , lcapitulino@redhat.com, eblake@redhat.com libvirt's sVirt security driver provides SELinux MAC isolation for Qemu guest processes and their corresponding image files. In other words, sVirt uses SELinux to prevent a QEMU process from opening files that do not belong to it. sVirt provides this support by labeling guests and resources with security labels that are stored in file system extended attributes. Some file systems, such as NFS, do not support the extended attribute security namespace, and therefore cannot support sVirt isolation. A solution to this problem is to provide fd passing support, where libvirt opens files and passes file descriptors to QEMU. This, along with SELinux policy to prevent QEMU from opening files, can provide image file isolation for NFS files stored on the same NFS mount. This patch series adds the add-fd, remove-fd, and query-fdsets QMP monitor commands, which allow file descriptors to be passed via SCM_RIGHTS, and assigned to specified fd sets. This allows fd sets to be created per file with fds having, for example, different access rights. When QEMU needs to reopen a file with different access rights, it can search for a matching fd in the fd set. Fd sets also allow for easy tracking of fds per file, helping to prevent fd leaks. Support is also added to the block layer to allow QEMU to dup an fd from an fdset when the filename is of the /dev/fdset/nnn format, where nnn is the fd set ID. No new SELinux policy is required to prevent open of NFS files (files with type nfs_t). The virt_use_nfs boolean type simply needs to be set to false, and open will be prevented (and dup will be allowed). For example: # setsebool virt_use_nfs 0 # getsebool virt_use_nfs virt_use_nfs --> off Corey Bryant (6): qemu-char: Add MSG_CMSG_CLOEXEC flag to recvmsg qapi: Introduce add-fd, remove-fd, query-fdsets monitor: Clean up fd sets on monitor disconnect block: Convert open calls to qemu_open block: Convert close calls to qemu_close block: Enable qemu_open/close to work with fd sets block/raw-posix.c | 42 ++++---- block/raw-win32.c | 6 +- block/vdi.c | 5 +- block/vmdk.c | 25 ++--- block/vpc.c | 4 +- block/vvfat.c | 16 +-- cutils.c | 5 + monitor.c | 287 ++++++++++++++++++++++++++++++++++++++++++++++++++++- monitor.h | 5 + osdep.c | 117 ++++++++++++++++++++++ qapi-schema.json | 103 +++++++++++++++++++ qemu-char.c | 12 ++- qemu-common.h | 2 + qemu-tool.c | 21 ++++ qerror.c | 4 + qerror.h | 3 + qmp-commands.hx | 126 +++++++++++++++++++++++ savevm.c | 4 +- 18 files changed, 732 insertions(+), 55 deletions(-) -- 1.7.10.4