From: "Daniel P. Berrange" <berrange@redhat.com>
To: Stefan Hajnoczi <stefanha@gmail.com>
Cc: aliguori@us.ibm.com, Corey Bryant <bryntcor@us.ibm.com>,
Tyler C Hicks <tchicks@us.ibm.com>,
qemu-devel@nongnu.org
Subject: Re: [Qemu-devel] [PATCH] Add support for fd: protocol
Date: Mon, 23 May 2011 11:30:27 +0100 [thread overview]
Message-ID: <20110523103027.GD24143@redhat.com> (raw)
In-Reply-To: <BANLkTi=HmjV5b_hKM3B-4O8Ub6JE-waXLw@mail.gmail.com>
On Mon, May 23, 2011 at 11:19:15AM +0100, Stefan Hajnoczi wrote:
> On Mon, May 23, 2011 at 10:45 AM, Daniel P. Berrange
> <berrange@redhat.com> wrote:
> > On Fri, May 20, 2011 at 02:48:23PM -0400, Corey Bryant wrote:
> >> sVirt provides SELinux MAC isolation for Qemu guest processes and their
> >> corresponding resources (image files). sVirt provides this support
> >> by labeling guests and resources with security labels that are stored
> >> in file system extended attributes. Some file systems, such as NFS, do
> >> not support the extended attribute security namespace, which is needed
> >> for image file isolation when using the sVirt SELinux security driver
> >> in libvirt.
> >>
> >> The proposed solution entails a combination of Qemu, libvirt, and
> >> SELinux patches that work together to isolate multiple guests' images
> >> when they're stored in the same NFS mount. This results in an
> >> environment where sVirt isolation and NFS image file isolation can both
> >> be provided.
> >>
> >> Currently, Qemu opens an image file in addition to performing the
> >> necessary read and write operations. The proposed solution will move
> >> the open out of Qemu and into libvirt. Once libvirt opens an image
> >> file for the guest, it will pass the file descriptor to Qemu via a
> >> new fd: protocol.
> >>
> >> If the image file resides in an NFS mount, the following SELinux policy
> >> changes will provide image isolation:
> >>
> >> - A new SELinux boolean is created (e.g. virt_read_write_nfs) to
> >> allow Qemu (svirt_t) to only have SELinux read and write
> >> permissions on nfs_t files
> >>
> >> - Qemu (svirt_t) also gets SELinux use permissions on libvirt
> >> (virtd_t) file descriptors
> >>
> >> Following is a sample invocation of Qemu using the fd: protocol:
> >>
> >> qemu -drive file=fd:4,format=qcow2
> >>
> >> This patch contains the Qemu code to support this solution. I would
> >> like to solicit input from the libvirt community prior to starting
> >> the libvirt patch.
> >>
> >> This patch was tested with the following formats: raw, cow, qcow,
> >> qcow2, vmdk, using the fd: protocol as well as existing file name
> >> support. Non-valid file descriptors were also tested.
> >
> > How can backing files work ? The '-drive' syntax doesn't provide
> > any way to set properties against the backing files (which may be
> > nested to arbitrary depth). AFAICT, we need to the often discussed
> > -blockdev advanced syntax to be able to set a 'fd' property against
> > nested backing files. I'm not sure it is worth supporting fd: if
> > we only have -drive syntax, since backing files are an important
> > feature for most mgmt apps.
> >
> > Also, there are a few places in QEMU, where it re-opens the existing
> > block driver on the fly. What is the plan for supporting this, without
> > having QEMU block on waiting for libvirt to pass it a new FD ?
>
> QEMU could ask for a file over QMP. So you bootstrap it using fd: but
> when a reopen or backing file is needed, QEMU raises a
> QEVENT_BLOCK_REQUEST_FILE event. Of course waiting around for the
> reopen to complete it not ideal as it may temporarily pause the guest.
It feels to me that turning the current block driver code which just does
open(2) on files, into something which issues events & asynchronously
waits for a file would potentially be quite complex.
You also need to be much more careful from a security POV if the mgmt
app is accepting requests to open arbitrary files from QEMU, to ensure
the filenames are correctly/strictly validated before opening them and
giving them back to QEMU. An architecture where the mgmt app decides
what FDs to supply upfront, has less potential for security errors.
To me the ideal would thus be that we can supply FDs for the backing
store with -blockdev syntax, and that places where QEMU re-opens files
would be enhanced to avoid that need. If there are things we can't do
without closing & re-opening the same file, then perhaps we need some
new ioctl()/fcntl() calls to change those file attributes on the fly.
Regards,
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
next prev parent reply other threads:[~2011-05-23 10:30 UTC|newest]
Thread overview: 26+ messages / expand[flat|nested] mbox.gz Atom feed top
2011-05-20 18:48 [Qemu-devel] [PATCH] Add support for fd: protocol Corey Bryant
2011-05-20 19:05 ` Anthony Liguori
2011-05-20 19:25 ` Blue Swirl
2011-05-20 19:42 ` Anthony Liguori
2011-05-20 19:53 ` Blue Swirl
2011-05-23 14:28 ` Kevin Wolf
2011-05-23 15:24 ` Markus Armbruster
2011-05-23 15:56 ` Kevin Wolf
2011-05-23 19:50 ` Blue Swirl
2011-05-23 21:55 ` Anthony Liguori
2011-05-23 18:20 ` Corey Bryant
2011-05-23 9:45 ` Daniel P. Berrange
2011-05-23 10:19 ` Stefan Hajnoczi
2011-05-23 10:30 ` Daniel P. Berrange [this message]
2011-05-23 12:59 ` Anthony Liguori
2011-05-23 14:35 ` Markus Armbruster
2011-05-23 22:49 ` Jamie Lokier
2011-05-24 8:39 ` Stefan Hajnoczi
2011-05-24 15:31 ` Jamie Lokier
2011-05-23 12:50 ` Anthony Liguori
2011-05-23 13:06 ` Daniel P. Berrange
2011-05-23 13:09 ` Stefan Hajnoczi
2011-05-23 13:21 ` Anthony Liguori
2011-05-23 13:26 ` Stefan Hajnoczi
2011-05-23 13:42 ` Daniel P. Berrange
2011-05-23 9:48 ` Daniel P. Berrange
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20110523103027.GD24143@redhat.com \
--to=berrange@redhat.com \
--cc=aliguori@us.ibm.com \
--cc=bryntcor@us.ibm.com \
--cc=qemu-devel@nongnu.org \
--cc=stefanha@gmail.com \
--cc=tchicks@us.ibm.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).