Re: [libvirt] [PATCH 6/7] Use cgroups for block device whitelisting in QEMU guests

> + > +int virCgroupDenyDevicePath(virCgroupPtr group, > + const char *path) > +{ > + struct stat sb; > + > + if (stat(path, &sb) < 0) > + return -errno; > + > + if (!S_ISCHR(sb.st_mode) && !S_ISBLK(sb.st_mode)) > + return -EINVAL; > + > + return virCgroupDenyDevice(group, > + S_ISCHR(sb.st_mode) ? 'c' : 'b', > + major(sb.st_rdev), > + minor(sb.st_rdev)); > +} [...] > diff --git a/src/qemu_driver.c b/src/qemu_driver.c > index f6d3f52..33e9cfa 100644 > --- a/src/qemu_driver.c > +++ b/src/qemu_driver.c > @@ -1378,12 +1378,19 @@ error: > return -1; > } > > +static const char *const devs[] = { > + "/dev/null", "/dev/full", "/dev/zero", > + "/dev/random", "/dev/urandom", > + "/dev/ptmx", "/dev/kvm", "/dev/kqemu", > +}; Hum, that list sounds a bit arbitrary, this could break for random reasons maybe this should be extended through the configuration, I assume a mismatch may result in domain failing to start or operate properly, right ?

[...] > + > + rc = virCgroupAllowDeviceMajor(cgroup, 'c', 136); Hum, that's a magic number, can we get a meaningful #define The idea sounds good but I'm a bit afraid of the inflexibility, this has the potential of making qemu/kvm far more fragile without a way to fix this by patching and recompiling.

Again I'm not a cgroup expert but I feel a bit uneasy, can we get at least an option to disable it at runtime in the configuration (sorry if I missed that !) ?