[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] Re: [Xen-devel] [PATCH v9] run QEMU as non-root
On Tue, 2015-11-03 at 16:49 +0000, Ian Campbell wrote: > On Mon, 2015-11-02 at 12:30 +0000, Stefano Stabellini wrote: > > Try to use "xen-qemudepriv-domid$domid" first, then > > "xen-qemudepriv-shared" and root if everything else fails. > > > > The uids need to be manually created by the user or, more likely, by > > the > > xen package maintainer. > > > > Expose a device_model_user setting in libxl_domain_build_info, so that > > opinionated callers, such as libvirt, can set any user they like. Do > > not > > fall back to root if device_model_user is set. Users can also set > > device_model_user by hand in the xl domain config file. > > > > QEMU is going to setuid and setgid to the user ID and the group ID of > > the specified user, soon after initialization, before starting to deal > > with any guest IO. > > > > To actually secure QEMU when running in Dom0, we need at least to > > deprivilege the privcmd and xenstore interfaces, this is just the first > > step in that direction. > > > > Signed-off-by: Stefano Stabellini <stefano.stabellini@xxxxxxxxxxxxx> > > Acked-by: Ian Campbell <ian.campbell@xxxxxxxxxx> There were some minor conflicts against some patches committed at the start of October. I had fixed them up (I think) but then I noticed thatÂdocs/misc/qemu-deprivilege.txt in my working tree wasn't actually committed. Since this patch refers to it, but didn't include it I checked before acking that it was already in tree some how, but didn't realise it wasn't actually committed (somehow, not sure how). Was it supposed to be in this patch or was it supposed to be in some earlier patch? In any case given something odd is clearly going on I don't want to just commit some random version of that doc which I just found in my working directory along with this patch. Please can you resubmit with that file included (or in a precursor patch). Also please check the coding style of the comment in libxl.h, the "/*" should be by itself. Thanks, Ian. > > (based on previous plus eyeballing only the changes from: > > Â > > Changes in v9: > > - add a device_model_user option to the xl domain config file > > Ian. > > _______________________________________________ > Xen-devel mailing list > Xen-devel@xxxxxxxxxxxxx > http://lists.xen.org/xen-devel _______________________________________________ Xen-devel mailing list Xen-devel@xxxxxxxxxxxxx http://lists.xen.org/xen-devel
|
Lists.xenproject.org is hosted with RackSpace, monitoring our |