Re: [libvirt] [PATCHv4 3/8] qemu: bulk stats: implement balloon group

On 09/12/2014 07:05 AM, Peter Krempa wrote: Oh, that's right. The reason we strongly prefer the event instead of the old command is that the old command blocked until the guest responded, but an uncooperative guest can use that to cause denial of service. Most qemu QMP commands reply immediately without waiting for guest interaction; and the balloon event allowed the same behavior there. So I think we do NOT want to allow balloon stats to work UNLESS qemu is new enough to provide them without guest interaction. If we DO allow guest interaction, then we need to modify remote_protocol.x to add ACL checks, so that the ACL controls can deny an unprivileged user from attempting a query that will potentially starve a privileged user. So I'd rather go with the stance that we cannot query stats that would require guest interaction, or at a minimum, gate things by having an explicit flag the caller must pass to acknowledge the risk (and having a flag lets us have a conditional ACL check, where the common case of not using the flag doesn't need to be slowed down by a check). -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org