From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:44442) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RYNPd-0008BX-Li for qemu-devel@nongnu.org; Wed, 07 Dec 2011 14:44:18 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RYNPc-0005RA-CZ for qemu-devel@nongnu.org; Wed, 07 Dec 2011 14:44:17 -0500 Received: from e8.ny.us.ibm.com ([32.97.182.138]:55364) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RYNPc-0005R2-8j for qemu-devel@nongnu.org; Wed, 07 Dec 2011 14:44:16 -0500 Received: from /spool/local by e8.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 7 Dec 2011 14:44:14 -0500 Received: from d01av01.pok.ibm.com (d01av01.pok.ibm.com [9.56.224.215]) by d01relay03.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pB7Jh55f299026 for ; Wed, 7 Dec 2011 14:43:06 -0500 Received: from d01av01.pok.ibm.com (loopback [127.0.0.1]) by d01av01.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pB7Jh4Jg013549 for ; Wed, 7 Dec 2011 14:43:05 -0500 Message-ID: <4EDFC1C5.4030902@linux.vnet.ibm.com> Date: Wed, 07 Dec 2011 14:43:01 -0500 From: Corey Bryant MIME-Version: 1.0 References: <1321242349-4140-1-git-send-email-coreyb@linux.vnet.ibm.com> In-Reply-To: <1321242349-4140-1-git-send-email-coreyb@linux.vnet.ibm.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH v5 0/4] -net bridge: rootless bridge support for qemu List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aliguori@us.ibm.com, rmarwah@linux.vnet.ibm.com On 11/13/2011 10:45 PM, Corey Bryant wrote: > With qemu it is possible to run a guest from an unprivileged user but if > we wanted to communicate with the outside world we had to switch > to root. > > We address this problem by introducing a new network backend and a new > network option for -net tap. This is less flexible when compared to > existing -net tap options because it relies on a helper with elevated > privileges to do the heavy lifting of allocating and attaching a tap > device to a bridge. We use a special purpose helper because we don't > want to elevate the privileges of more generic tools like brctl. > > Qemu can be run with the default network helper as follows (in these cases > attaching the tap device to the default br0 bridge): > > qemu linux.img -net bridge -net nic,model=virtio > > qemu linux.img -net tap,helper=/usr/local/libexec/qemu-bridge-helper > -net nic,model=virtio > > qemu linux.img -netdev bridge,id=hn0 > -device virtio-net-pci,netdev=hn0,id=nic1 > > qemu linux.img -netdev tap,helper=/usr/local/libexec/qemu-bridge-helper,id=hn0 > -device virtio-net-pci,netdev=hn0,id=nic1 > > The default helper uses it's own ACL mechanism for access control, but > future network helpers could be developed, for example, to support PolicyKit > for access control. > > More details are included in individual patches. The helper is broken into > a series of patches to improve reviewabilty. > > v2: > - Updated signed-off-by's > - Updated author's email > - Set default bridge to br0 > - Added -net bridge > - Updated ACL example > - Moved from libcap to libcap-ng > - Fail helper when libcap-ng not configured > > v3: > - Use simple queue to store ACLs > - Added goto cleanup to helper's main > - Allow helper execution if libcap-ng not configured > - Completed static analysis and memory analysis on helper > > v4: > - Update has_vnet_hdr() to return bool > - Update helper's main() to prevent errno clobbering > - Let Kernel cleanup helper's file descriptors > > v5: > - Removed if statement with TUNGETIFF ioctl() from has_vnet_hdr() > - Added -netdev examples and udpated qemu -help netdev documentation > - Disallow vnet_hdr option with -net tap,helper > > Corey Bryant (4): > Add basic version of bridge helper > Add access control support to qemu bridge helper > Add cap reduction support to enable use as SUID > Add support for net bridge > > Makefile | 12 ++- > configure | 37 +++++ > net.c | 29 ++++- > net.h | 3 + > net/tap.c | 191 +++++++++++++++++++++++- > net/tap.h | 3 + > qemu-bridge-helper.c | 402 ++++++++++++++++++++++++++++++++++++++++++++++++++ > qemu-options.hx | 74 ++++++++-- > 8 files changed, 728 insertions(+), 23 deletions(-) > create mode 100644 qemu-bridge-helper.c > Does anyone have any comments on this patch series? I haven't received any thus far for this version. Surely no news can't be good news. :) -- Regards, Corey