qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH v2 0/4] file descriptor passing using passfd
@ 2012-06-08 15:42 Corey Bryant
  2012-06-08 15:42 ` [Qemu-devel] [PATCH v2 1/4] qapi: Convert getfd and closefd Corey Bryant
                   ` (5 more replies)
  0 siblings, 6 replies; 24+ messages in thread
From: Corey Bryant @ 2012-06-08 15:42 UTC (permalink / raw)
  To: qemu-devel; +Cc: kwolf, aliguori, stefanha, libvir-list, Corey Bryant, eblake

libvirt's sVirt security driver provides SELinux MAC isolation for
Qemu guest processes and their corresponding image files.  In other
words, sVirt uses SELinux to prevent a QEMU process from opening
files that do not belong to it.

sVirt provides this support by labeling guests and resources with
security labels that are stored in file system extended attributes.
Some file systems, such as NFS, do not support the extended
attribute security namespace, and therefore cannot support sVirt
isolation.

A solution to this problem is to provide fd passing support, where
libvirt opens files and passes file descriptors to QEMU.  This,
along with SELinux policy to prevent QEMU from opening files, can
provide image file isolation for NFS files stored on the same NFS
mount.

This patch series adds the passfd QMP monitor command, which allows
an fd to be passed via SCM_RIGHTS, and returns the received file
descriptor.  Support is also added to the block layer to allow QEMU
to dup the fd when the filename is of the /dev/fd/X format.  This
is useful if MAC policy prevents QEMU from opening specific types
of files.

One nice thing about this approach is that no new SELinux policy is
required to prevent open of NFS files (files with type nfs_t).  The
virt_use_nfs boolean type simply needs to be set to false, and open
will be prevented (and dup will be allowed).  For example:

    # setsebool virt_use_nfs 0
    # getsebool virt_use_nfs
    virt_use_nfs --> off

Corey Bryant (4):
  qapi: Convert getfd and closefd
  qapi: Add passfd QMP command
  osdep: Enable qemu_open to dup pre-opened fd
  block: Convert open calls to qemu_open

 block/raw-posix.c |   18 +++++++++---------
 block/raw-win32.c |    4 ++--
 block/vdi.c       |    5 +++--
 block/vmdk.c      |   21 +++++++++------------
 block/vpc.c       |    2 +-
 block/vvfat.c     |   21 +++++++++++----------
 hmp-commands.hx   |    6 ++----
 hmp.c             |   18 ++++++++++++++++++
 hmp.h             |    2 ++
 monitor.c         |   36 ++++++++++++++++++++----------------
 osdep.c           |   13 +++++++++++++
 qapi-schema.json  |   44 ++++++++++++++++++++++++++++++++++++++++++++
 qmp-commands.hx   |   33 +++++++++++++++++++++++++++++----
 13 files changed, 163 insertions(+), 60 deletions(-)

-- 
1.7.10.2

^ permalink raw reply	[flat|nested] 24+ messages in thread
* [Qemu-devel] [PATCH v2 0/4] file descriptor passing using passfd
@ 2012-06-08 14:53 Corey Bryant
  2012-06-08 14:53 ` [Qemu-devel] [PATCH v2 2/4] qapi: Add passfd QMP command Corey Bryant
  0 siblings, 1 reply; 24+ messages in thread
From: Corey Bryant @ 2012-06-08 14:53 UTC (permalink / raw)
  To: qemu-devel; +Cc: kwolf, aliguori, stefanha, libvir-list, Corey Bryant, eblake

libvirt's sVirt security driver provides SELinux MAC isolation for
Qemu guest processes and their corresponding image files.  In other
words, sVirt uses SELinux to prevent a QEMU process from opening
files that do not belong to it.

sVirt provides this support by labeling guests and resources with
security labels that are stored in file system extended attributes.
Some file systems, such as NFS, do not support the extended
attribute security namespace, and therefore cannot support sVirt
isolation.

A solution to this problem is to provide fd passing support, where
libvirt opens files and passes file descriptors to QEMU.  This,
along with SELinux policy to prevent QEMU from opening files, can
provide image file isolation for NFS files stored on the same NFS
mount.

This patch series adds the passfd QMP monitor command, which allows
an fd to be passed via SCM_RIGHTS, and returns the received file
descriptor.  Support is also added to the block layer to allow QEMU
to dup the fd when the filename is of the /dev/fd/X format.  This
is useful if MAC policy prevents QEMU from opening specific types
of files.

One nice thing about this approach is that no new SELinux policy is
required to prevent open of NFS files (files with type nfs_t).  The
virt_use_nfs boolean type simply needs to be set to false, and open
will be prevented (and dup will be allowed).  For example:

    # setsebool virt_use_nfs 0
    # getsebool virt_use_nfs
    virt_use_nfs --> off

Corey Bryant (4):
  qapi: Convert getfd and closefd
  qapi: Add passfd QMP command
  osdep: Enable qemu_open to dup pre-opened fd
  block: Convert open calls to qemu_open

 block/raw-posix.c |   18 +++++++++---------
 block/raw-win32.c |    4 ++--
 block/vdi.c       |    5 +++--
 block/vmdk.c      |   21 +++++++++------------
 block/vpc.c       |    2 +-
 block/vvfat.c     |   21 +++++++++++----------
 hmp-commands.hx   |    6 ++----
 hmp.c             |   18 ++++++++++++++++++
 hmp.h             |    2 ++
 monitor.c         |   36 ++++++++++++++++++++----------------
 osdep.c           |   13 +++++++++++++
 qapi-schema.json  |   44 ++++++++++++++++++++++++++++++++++++++++++++
 qmp-commands.hx   |   33 +++++++++++++++++++++++++++++----
 13 files changed, 163 insertions(+), 60 deletions(-)

-- 
1.7.10.2

^ permalink raw reply	[flat|nested] 24+ messages in thread
* [Qemu-devel] [PATCH v2 0/4] file descriptor passing using passfd
@ 2012-06-08 14:49 Corey Bryant
  2012-06-08 14:49 ` [Qemu-devel] [PATCH v2 2/4] qapi: Add passfd QMP command Corey Bryant
  0 siblings, 1 reply; 24+ messages in thread
From: Corey Bryant @ 2012-06-08 14:49 UTC (permalink / raw)
  To: qemu-devel; +Cc: kwolf, aliguori, stefanha, libvir-list, Corey Bryant, eblake

libvirt's sVirt security driver provides SELinux MAC isolation for
Qemu guest processes and their corresponding image files.  In other
words, sVirt uses SELinux to prevent a QEMU process from opening
files that do not belong to it.

sVirt provides this support by labeling guests and resources with
security labels that are stored in file system extended attributes.
Some file systems, such as NFS, do not support the extended
attribute security namespace, and therefore cannot support sVirt
isolation.

A solution to this problem is to provide fd passing support, where
libvirt opens files and passes file descriptors to QEMU.  This,
along with SELinux policy to prevent QEMU from opening files, can
provide image file isolation for NFS files stored on the same NFS
mount.

This patch series adds the passfd QMP monitor command, which allows
an fd to be passed via SCM_RIGHTS, and returns the received file
descriptor.  Support is also added to the block layer to allow QEMU
to dup the fd when the filename is of the /dev/fd/X format.  This
is useful if MAC policy prevents QEMU from opening specific types
of files.

One nice thing about this approach is that no new SELinux policy is
required to prevent open of NFS files (files with type nfs_t).  The
virt_use_nfs boolean type simply needs to be set to false, and open
will be prevented (and dup will be allowed).  For example:

    # setsebool virt_use_nfs 0
    # getsebool virt_use_nfs
    virt_use_nfs --> off

Corey Bryant (4):
  qapi: Convert getfd and closefd
  qapi: Add passfd QMP command
  osdep: Enable qemu_open to dup pre-opened fd
  block: Convert open calls to qemu_open

 block/raw-posix.c |   18 +++++++++---------
 block/raw-win32.c |    4 ++--
 block/vdi.c       |    5 +++--
 block/vmdk.c      |   21 +++++++++------------
 block/vpc.c       |    2 +-
 block/vvfat.c     |   21 +++++++++++----------
 hmp-commands.hx   |    6 ++----
 hmp.c             |   18 ++++++++++++++++++
 hmp.h             |    2 ++
 monitor.c         |   36 ++++++++++++++++++++----------------
 osdep.c           |   13 +++++++++++++
 qapi-schema.json  |   44 ++++++++++++++++++++++++++++++++++++++++++++
 qmp-commands.hx   |   33 +++++++++++++++++++++++++++++----
 13 files changed, 163 insertions(+), 60 deletions(-)

-- 
1.7.10.2

^ permalink raw reply	[flat|nested] 24+ messages in thread

end of thread, other threads:[~2012-06-14 13:28 UTC | newest]

Thread overview: 24+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-06-08 15:42 [Qemu-devel] [PATCH v2 0/4] file descriptor passing using passfd Corey Bryant
2012-06-08 15:42 ` [Qemu-devel] [PATCH v2 1/4] qapi: Convert getfd and closefd Corey Bryant
2012-06-13 19:41   ` Luiz Capitulino
2012-06-13 20:10     ` Corey Bryant
2012-06-13 19:42   ` Luiz Capitulino
2012-06-13 20:17     ` Corey Bryant
2012-06-13 20:41       ` Luiz Capitulino
2012-06-13 20:41       ` Eric Blake
2012-06-13 21:43         ` Corey Bryant
2012-06-08 15:42 ` [Qemu-devel] [PATCH v2 2/4] qapi: Add passfd QMP command Corey Bryant
2012-06-13 19:46   ` Luiz Capitulino
2012-06-13 20:25     ` Corey Bryant
2012-06-13 20:47       ` Eric Blake
2012-06-13 22:07         ` Corey Bryant
2012-06-14 13:28           ` Luiz Capitulino
2012-06-08 15:42 ` [Qemu-devel] [PATCH v2 3/4] osdep: Enable qemu_open to dup pre-opened fd Corey Bryant
2012-06-08 15:42 ` [Qemu-devel] [PATCH v2 4/4] block: Convert open calls to qemu_open Corey Bryant
2012-06-13 10:26   ` Kevin Wolf
2012-06-13 14:30     ` Corey Bryant
2012-06-08 17:10 ` [Qemu-devel] [PATCH v2 0/4] file descriptor passing using passfd Corey Bryant
2012-06-13 10:28 ` Kevin Wolf
2012-06-13 14:31   ` Corey Bryant
  -- strict thread matches above, loose matches on Subject: below --
2012-06-08 14:53 Corey Bryant
2012-06-08 14:53 ` [Qemu-devel] [PATCH v2 2/4] qapi: Add passfd QMP command Corey Bryant
2012-06-08 14:49 [Qemu-devel] [PATCH v2 0/4] file descriptor passing using passfd Corey Bryant
2012-06-08 14:49 ` [Qemu-devel] [PATCH v2 2/4] qapi: Add passfd QMP command Corey Bryant

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).