From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:43651) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Slz5N-0003Yw-Mw for qemu-devel@nongnu.org; Tue, 03 Jul 2012 05:07:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Slz5I-0007iy-7Y for qemu-devel@nongnu.org; Tue, 03 Jul 2012 05:07:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37279) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Slz5H-0007ig-Vv for qemu-devel@nongnu.org; Tue, 03 Jul 2012 05:07:48 -0400 Date: Tue, 3 Jul 2012 10:07:37 +0100 From: "Daniel P. Berrange" Message-ID: <20120703090736.GC12702@redhat.com> References: <1340390174-7493-1-git-send-email-coreyb@linux.vnet.ibm.com> <20120626091004.GA14451@redhat.com> <4FE9A0F0.2050809@redhat.com> <20120626175045.2c7011b3@doriath.home> <4FEA37A9.10707@linux.vnet.ibm.com> <4FEA3D9C.8080205@redhat.com> <4FF21A67.8010100@linux.vnet.ibm.com> <4FF2212D.9020608@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <4FF2212D.9020608@redhat.com> Subject: Re: [Qemu-devel] [PATCH v4 0/7] file descriptor passing using pass-fd Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eric Blake Cc: Kevin Wolf , aliguori@us.ibm.com, stefanha@linux.vnet.ibm.com, libvir-list@redhat.com, Corey Bryant , qemu-devel@nongnu.org, Luiz Capitulino , pbonzini@redhat.com On Mon, Jul 02, 2012 at 04:31:09PM -0600, Eric Blake wrote: > On 07/02/2012 04:02 PM, Corey Bryant wrote: > > > Here's another option that Kevin and I discussed today on IRC. I've > > modified a few minor details since the discussion. And Kevin please > > correct me if anything is wrong. > > > > Proposal Four: Pass a set of fds via 'pass-fds'. The group of fds > > should all refer to the same file, but may have different access flags > > (ie. O_RDWR, O_RDONLY). qemu_open can then dup the fd that has the > > matching access mode flags. > > But this means that libvirt has to open a file O_RDWR up front for any > file that it _might_ need qemu to reopen later, and that qemu is now > hanging on to 2 fds per fdset instead of 1 fd for the life of any client > of the fdset. > > I see no reason why libvirt can't pass in an O_RDWR fd when qemu only > needs to use an O_RDONLY fd; If libvirt has only granted read-only access to the file with sVirt, then passing a O_RDWR file handle to QEMU will result in an SELinux denial, even if QEMU doesn't try to do I/O on it. So this is out of the question. Regards, Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|