Re: [libvirt] [PATCH V9 3/3] Add support for file descriptor sets

On 03/07/2013 11:14 AM, Stefan Berger wrote: Discussion on the qemu list has made it obvious that we want this for NFS-mounted images, but maybe not for local images or on other file systems that actually support SELinux labeling (after all, the point of fd passing is not to move DAC checking out of the kernel and into user-space libvirtd, but to make up for lack of SELinux labeling on NFS). Still, we are waiting for a qemu solution on how to do fd passing for backing files (the so-called -blockdev design), which means that for now, the best we could do with the selinux bool virt_use_nfs disabled is support only flat images (no backing file, no creation of snapshots). And here, these files support SELinux labeling, so maybe fd passing is overkill, other than proof of concept that we are doing fd passing correctly. So, I'm debating on how much of this patch needs to be applied, or whether we should split it into smaller chunks to ease backporting of some portions to older libvirt without dragging in everything. Still, this looks interesting, and the framework it sets up looks like it will be reusable as we start thinking about fd passing and implications on hotplug. I'm still working on my reply to the actual contents... -- Eric Blake eblake redhat com +1-919-301-3266 Libvirt virtualization library http://libvirt.org