Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Corey Bryant
On 10/23/2011 09:22 AM, Blue Swirl wrote: On Fri, Oct 21, 2011 at 15:07, Corey Bryantcor...@linux.vnet.ibm.com wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Blue Swirl
On Mon, Oct 24, 2011 at 14:13, Corey Bryant cor...@linux.vnet.ibm.com wrote: On 10/23/2011 09:22 AM, Blue Swirl wrote: On Fri, Oct 21, 2011 at 15:07, Corey Bryantcor...@linux.vnet.ibm.com  wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using:  setcap

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Corey Bryant
On 10/24/2011 01:10 PM, Blue Swirl wrote: On Mon, Oct 24, 2011 at 14:13, Corey Bryantcor...@linux.vnet.ibm.com wrote: On 10/23/2011 09:22 AM, Blue Swirl wrote: On Fri, Oct 21, 2011 at 15:07, Corey Bryantcor...@linux.vnet.ibm.com wrote: The ideal way to use qemu-bridge-helper is to

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Blue Swirl
On Mon, Oct 24, 2011 at 18:38, Corey Bryant cor...@linux.vnet.ibm.com wrote: On 10/24/2011 01:10 PM, Blue Swirl wrote: On Mon, Oct 24, 2011 at 14:13, Corey Bryantcor...@linux.vnet.ibm.com  wrote: On 10/23/2011 09:22 AM, Blue Swirl wrote: On Fri, Oct 21, 2011 at 15:07, Corey

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Corey Bryant
On 10/24/2011 02:58 PM, Blue Swirl wrote: On Mon, Oct 24, 2011 at 18:38, Corey Bryantcor...@linux.vnet.ibm.com wrote: On 10/24/2011 01:10 PM, Blue Swirl wrote: On Mon, Oct 24, 2011 at 14:13, Corey Bryantcor...@linux.vnet.ibm.com wrote: On 10/23/2011 09:22 AM, Blue Swirl wrote: On

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Anthony Liguori
On 10/24/2011 09:13 AM, Corey Bryant wrote: On 10/23/2011 09:22 AM, Blue Swirl wrote: On Fri, Oct 21, 2011 at 15:07, Corey Bryantcor...@linux.vnet.ibm.com wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Anthony Liguori
On 10/24/2011 02:13 PM, Corey Bryant wrote: Right, it's not desirable, but isn't that the best we can do without libcap or FS capabilities? I think the best we can do is not let it run in those cases. :) I'd like see if others in the community have an opinion on this though. IMHO, it should

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Corey Bryant
On 10/24/2011 03:21 PM, Anthony Liguori wrote: On 10/24/2011 02:13 PM, Corey Bryant wrote: Right, it's not desirable, but isn't that the best we can do without libcap or FS capabilities? I think the best we can do is not let it run in those cases. :) I'd like see if others in the community

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-24 Thread Anthony Liguori
On 10/24/2011 03:20 PM, Corey Bryant wrote: On 10/24/2011 03:21 PM, Anthony Liguori wrote: On 10/24/2011 02:13 PM, Corey Bryant wrote: Right, it's not desirable, but isn't that the best we can do without libcap or FS capabilities? I think the best we can do is not let it run in those cases.

Re: [Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-23 Thread Blue Swirl
On Fri, Oct 21, 2011 at 15:07, Corey Bryant cor...@linux.vnet.ibm.com wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using:  setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied.  

[Qemu-devel] [PATCH v2 3/4] Add cap reduction support to enable use as SUID

2011-10-21 Thread Corey Bryant
The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve