From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:40469) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCG7B-00072D-UA for qemu-devel@nongnu.org; Sun, 03 Mar 2013 16:06:38 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UCG75-00065V-SV for qemu-devel@nongnu.org; Sun, 03 Mar 2013 16:06:37 -0500 Received: from mail-oa0-f47.google.com ([209.85.219.47]:42159) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UCG75-00065M-NU for qemu-devel@nongnu.org; Sun, 03 Mar 2013 16:06:31 -0500 Received: by mail-oa0-f47.google.com with SMTP id o17so8131488oag.6 for ; Sun, 03 Mar 2013 13:06:31 -0800 (PST) From: Anthony Liguori In-Reply-To: <51317357.60605@linux.vnet.ibm.com> References: <512FF819.7050505@redhat.com> <87k3pqzy2y.fsf@codemonkey.ws> <513110D3.5030503@linux.vnet.ibm.com> <87d2vig75m.fsf@codemonkey.ws> <51311A13.6030205@redhat.com> <87r4jy90wt.fsf@codemonkey.ws> <51313660.5010001@redhat.com> <87vc9apt7r.fsf@codemonkey.ws> <51314914.5000804@linux.vnet.ibm.com> <87lia6fq2a.fsf@codemonkey.ws> <51317357.60605@linux.vnet.ibm.com> Date: Sun, 03 Mar 2013 15:06:12 -0600 Message-ID: <871ubw9osb.fsf@codemonkey.ws> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Subject: Re: [Qemu-devel] virtio-rng and fd passing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Berger Cc: "qemu-devel@nongnu.org" Stefan Berger writes: > It depends on what one defends against. If a jail-break succeeds and > open() is disabled, then that attack surfaces was effectively reduced. > It's hard to say whether opening files within libvirt could then allow > new exploits. Well, in the very least, libvirt is doing the open() as root whereas QEMU does it as an unprivileged user. Regards, Anthony Liguori > > Stefan