Re: [libvirt] [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd
On 05/02/2012 04:45 AM, Kevin Wolf wrote:
Am 02.05.2012 10:53, schrieb Daniel P. Berrange:
> I would much prefer to see us be able to pass FDs in directly alongside
> the disk config as we do for netdev TAP/etc, and for QEMU / kernel to be
> fixed so that you do not need to re-open FDs on the fly.
I agree, and this is what -blockdev would give us.
Part of why I don't like the RFC (apart from RPCing the management tool
being just wrong) is that once again it's trying to take shortcuts and
only provide a hack for the urgent need instead of doing it properly and
implementing -blockdev.
The proper way to address this problem is *not* -blockdev. -blockdev is another
short cut.
The proper way to solve this problem is to add extended attribute to SELinux.
Another proper solution is for libvirt to launch guests with different UIDs and
use DAC to prevent guests from opening files.
I suspect that if we take something half-baked
like this, we will keep being unhappy with the situation in the block
layer, but it won't hurt enough any more to actually spend effort on it,
so that we'll go another five years with it.
Wanting to refactor the block layer is great. I am fully in support of it. But
holding practical features hostage is not reasonable.
There is nothing intrinsically cleaner about using -blockdev fd=X verses using
an RPC like this. -blockdev has a lot of nice characteristics but solving this
problem is not one of them.
Regards,
Anthony Liguori
Kevin