From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([140.186.70.92]:56088) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RaAeP-0001Ap-EL for qemu-devel@nongnu.org; Mon, 12 Dec 2011 13:30:58 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1RaAeN-0006Oh-5r for qemu-devel@nongnu.org; Mon, 12 Dec 2011 13:30:57 -0500 Received: from e35.co.us.ibm.com ([32.97.110.153]:41382) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1RaAeM-0006Mq-5a for qemu-devel@nongnu.org; Mon, 12 Dec 2011 13:30:54 -0500 Received: from /spool/local by e35.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 12 Dec 2011 11:30:50 -0700 Received: from d03av06.boulder.ibm.com (d03av06.boulder.ibm.com [9.17.195.245]) by d03relay04.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id pBCIU5ab138490 for ; Mon, 12 Dec 2011 11:30:05 -0700 Received: from d03av06.boulder.ibm.com (loopback [127.0.0.1]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id pBCIU4cj028203 for ; Mon, 12 Dec 2011 11:30:05 -0700 Message-ID: <4EE64829.4000007@linux.vnet.ibm.com> Date: Mon, 12 Dec 2011 13:30:01 -0500 From: Corey Bryant MIME-Version: 1.0 References: <4EDFAF91.4070904@linux.vnet.ibm.com> In-Reply-To: Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [RFC] Device sandboxing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Blue Swirl Cc: Ashley D Lai , Anthony Liguori , Stefan Hajnoczi , Michael Halcrow , qemu-devel@nongnu.org, Eric Paris , Paul Moore , =?UTF-8?B?UmFkaW0gS3LEjW3DocWZ?= , Avi Kivity , Richa Marwaha , Amit Shah , Eduardo Terrell Ferrari Otubo , Lee Terrell , George Wilson On 12/08/2011 04:51 PM, Blue Swirl wrote: > Why limit this to device emulation only? Where in QEMU would this > approach not work? That's a good point, and we've thrown this idea around. I don't know if there's any reason why this approach wouldn't work for all of QEMU. The idea for now though is to target the most vulnerable code, devices. -- Regards, Corey