Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-27 Thread Paolo Bonzini
On 01/27/2012 08:18 AM, Taku Izumi wrote: In any case adding rawio (which is a per-process capability) to adisk element would be wrong. It is true that process capability affects not per disk but a domain. It's a bit strange, but it is OK in my personal opinion. No, this must be made very

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-27 Thread Daniel P. Berrange
On Fri, Jan 27, 2012 at 09:38:48AM +0100, Paolo Bonzini wrote: On 01/27/2012 08:18 AM, Taku Izumi wrote: In any case adding rawio (which is a per-process capability) to adisk element would be wrong. It is true that process capability affects not per disk but a domain. It's a bit

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-27 Thread Paolo Bonzini
On 01/27/2012 02:30 PM, Daniel P. Berrange wrote: Yep, I tend to agree. We should have 1. rawio=yes|nmo on thedisk element somewhere 2. Give the QEMU process CAP_SYS_RAWIO 3. Use the devices cgroup to specify which individual disks can use rawio. That said I don't think we

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-21 Thread Paolo Bonzini
On 01/20/2012 07:25 AM, Taku Izumi wrote: OK. I'll try to implement like this way. No, I think your current patch is fine. Perhaps in the future we can try to implement cgroup-based whitelists in the kernel. In any case adding rawio (which is a per-process capability) to a disk element

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-20 Thread Paolo Bonzini
On 01/19/2012 10:48 PM, Eric Blake wrote: On 01/19/2012 02:10 PM, Daniel P. Berrange wrote: On Thu, Jan 19, 2012 at 01:32:08PM -0700, Eric Blake wrote: On 01/18/2012 12:38 AM, Taku Izumi wrote: I am now wondering if we should do this in a different way. ie if there is some XML configuration

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-19 Thread Daniel P. Berrange
On Thu, Jan 19, 2012 at 01:32:08PM -0700, Eric Blake wrote: On 01/18/2012 12:38 AM, Taku Izumi wrote: I am now wondering if we should do this in a different way. ie if there is some XML configuration parameter for the disk that indicates the need for rawio, then libvirt could automatically

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-19 Thread Eric Blake
On 01/19/2012 02:10 PM, Daniel P. Berrange wrote: On Thu, Jan 19, 2012 at 01:32:08PM -0700, Eric Blake wrote: On 01/18/2012 12:38 AM, Taku Izumi wrote: I am now wondering if we should do this in a different way. ie if there is some XML configuration parameter for the disk that indicates the

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-19 Thread Taku Izumi
On Thu, 19 Jan 2012 14:48:41 -0700 Eric Blake ebl...@redhat.com wrote: On 01/19/2012 02:10 PM, Daniel P. Berrange wrote: On Thu, Jan 19, 2012 at 01:32:08PM -0700, Eric Blake wrote: On 01/18/2012 12:38 AM, Taku Izumi wrote: I am now wondering if we should do this in a different way. ie if

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-17 Thread Taku Izumi
Sorry for late response. On Fri, 13 Jan 2012 14:46:08 + Daniel P. Berrange berra...@redhat.com wrote: On Thu, Jan 12, 2012 at 04:25:27PM +0900, Taku Izumi wrote: Hi Osier-san, Daniel-san, and all, This patchset adds an option for KVM guests to retain arbitrary capabilities.

Re: [libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-13 Thread Daniel P. Berrange
On Thu, Jan 12, 2012 at 04:25:27PM +0900, Taku Izumi wrote: Hi Osier-san, Daniel-san, and all, This patchset adds an option for KVM guests to retain arbitrary capabilities. The previous versions are here: http://www.redhat.com/archives/libvir-list/2011-December/msg00857.html

[libvirt] [PATCH v3 0/5] RFC: grant KVM guests retain arbitrary capabilities

2012-01-11 Thread Taku Izumi
Hi Osier-san, Daniel-san, and all, This patchset adds an option for KVM guests to retain arbitrary capabilities. The previous versions are here: http://www.redhat.com/archives/libvir-list/2011-December/msg00857.html http://www.redhat.com/archives/libvir-list/2011-December/msg00950.html v2