[libvirt] [PATCH v2 0/2] qemu: invoke qemu-bridge-helper from libvirtd

Paolo Bonzini pbonzini at redhat.com
Sat Apr 20 09:11:23 UTC 2013


The <interface type='bridge'> is working mostly because of a peculiar
design decision in Linux.  Ideally, QEMU would run with an empty
capability bounding set and would not be able to do any privileged
operation (not even by running a helper program).  This is not the case
because dropping capabilities from the bounding set requires a capability
of its own, CAP_SETPCAP; thus QEMU does *not* run with an empty bounding
set if invoked via qemu:///session.  This is apparently for security
reasons, to avoid that dropping _some_ caps but not all of them lets
you exploit untested error paths in suid binaries.

This series lets libvirtd invoke the privileged helper program on its own,
which is a cleaner design that would work even if the above Linux quirk
was not there.  Also, this adds a <target dev='tap0'/> element to the
XML of an active domain using <interface type='bridge'>.

Thanks to the patches that have already been committed, the recvfd and
virCommand APIs make the task almost trivial.

v1->v2: OOM fix in patch 1, change label name in patch 2, rebase

Paolo Bonzini (2):
  virnetdevtap: add virNetDevTapGetName
  qemu: launch bridge helper from libvirtd

 src/libvirt_private.syms |   1 +
 src/qemu/qemu_command.c  | 133 ++++++++++++++++++++++++++++++++++-------------
 src/qemu/qemu_command.h  |   1 -
 src/qemu/qemu_hotplug.c  |  25 +++------
 src/util/virnetdevtap.c  |  33 ++++++++++++
 src/util/virnetdevtap.h  |   3 ++
 6 files changed, 143 insertions(+), 53 deletions(-)

-- 
1.8.2




More information about the libvir-list mailing list