Re: [libvirt] [PATCH 6/7] Use cgroups for block device whitelisting in QEMU guests

On Fri, Jul 17, 2009 at 05:15:15PM +0200, Daniel Veillard wrote: > > +static const char *const devs[] = { > > + "/dev/null", "/dev/full", "/dev/zero", > > + "/dev/random", "/dev/urandom", > > + "/dev/ptmx", "/dev/kvm", "/dev/kqemu", > > +}; > > Hum, that list sounds a bit arbitrary, this could break for random > reasons maybe this should be extended through the configuration, I > assume a mismatch may result in domain failing to start or operate > properly, right ? Yes, QEMU will get -EPERM if it attempts to access a block device we've not permitted, and hopefully exit. Looking at it again, I've missed a couple of devices I should have allowed. I'll check the QEMU source to match up the list properly

> The idea sounds good but I'm a bit afraid of the inflexibility, > this has the potential of making qemu/kvm far more fragile without > a way to fix this by patching and recompiling. Perhaps we should make it a config in /etc/libvirt/qemu.conf too

> Again I'm not a cgroup expert but I feel a bit uneasy, can we get > at least an option to disable it at runtime in the configuration (sorry > if I missed that !) ? Well the simplest way to disable it at runtime, is to simply not mount the cgroups device ACL controller on the host. If this is not mounted, then libvirt will just skip this functionality. NB, no cgroups stuff is enabled by default on any current distro I'm aware of. Arguably this should be changed, but that's not libvirt's problem