From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:46906) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QjS8D-0004GL-Jt for qemu-devel@nongnu.org; Wed, 20 Jul 2011 04:27:51 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1QjS86-0001Rr-Uf for qemu-devel@nongnu.org; Wed, 20 Jul 2011 04:27:49 -0400 Received: from mx1.redhat.com ([209.132.183.28]:24032) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1QjS86-0001Rg-DE for qemu-devel@nongnu.org; Wed, 20 Jul 2011 04:27:42 -0400 Message-ID: <4E269101.8030904@redhat.com> Date: Wed, 20 Jul 2011 10:25:37 +0200 From: Jes Sorensen MIME-Version: 1.0 References: <4E2055AE.8090107@redhat.com> <4E253136.4080509@redhat.com> <4E258635.2040108@redhat.com> <4E258D70.6000205@redhat.com> <4E25902D.2000403@redhat.com> <4E2593B0.1030508@redhat.com> <4E2594FB.4050203@redhat.com> <4E25AD51.4000802@codemonkey.ws> In-Reply-To: <4E25AD51.4000802@codemonkey.ws> Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] live snapshot wiki updated List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: "libvir-list@redhat.com" , Stefan Hajnoczi , Eric Blake , QEMU Developers , Stefan Hajnoczi On 07/19/11 18:14, Anthony Liguori wrote: >>> As nice as that sentiment is, it will never fly, because it would be a >>> regression in current behavior. The whole reason that the virt_use_nfs >>> SELinux bool exists is that some people are willing to make the partial >>> security tradeoff. Besides, the use of sVirt via SELinux is more than >>> just open() protection - while the current virt_use_nfs bool makes NFS >>> less secure than otherwise possible, it still gives some nice guarantees >>> to the rest of the qemu process such as passthrough accesses to local >>> pci devices. >> >> Well leaving things at status quo is not making it worse, it just leaves >> an evil in place. > > NFS and SELinux is a fundamental problem with SELinux and NFS. We can > piss and moan as much as we want about it but it's reality. SELinux > fundamentally requires extended attributes. By the time NFS adds > extended attribute support, we'll all be flying around in hover cars. > > As terrible as NFS is, people use it all of the time. > > It would be nice if libvirt had the ability to make better use of DAC to > support isolation. The fact that MAC is the only way you can do > isolation between guests is pretty unfortunate. If I could assign > specific UIDs to a guest and use that to enforce isolation, it would go > a long ways to solving this problem. Right, we're stuck with the two horros of NFS and selinux, so we need something that gets around the problem. In a sane world we would simply say 'no NFS, no selinux', but as you say that will never happen. My suggestion of a callback mechanism where libvirt registers the callback with QEMU for open() calls, allowing libvirt to perform the open and return the open file descriptor would get around this problem. Jes