Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-02 Thread Kevin Wolf
Am 02.05.2012 10:27, schrieb Stefan Hajnoczi: > On Wed, May 2, 2012 at 9:20 AM, Kevin Wolf wrote: >> Am 01.05.2012 22:25, schrieb Anthony Liguori: >>> Thanks for sending this out Stefan. >>> >>> On 05/01/2012 10:31 AM, Stefan Hajnoczi wrote: Libvirt can take advantage of SELinux to restrict t

Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-02 Thread Daniel P. Berrange
On Tue, May 01, 2012 at 04:31:42PM +0100, Stefan Hajnoczi wrote: > Libvirt can take advantage of SELinux to restrict the QEMU process and prevent > it from opening files that it should not have access to. This improves > security because it prevents the attacker from escaping the QEMU process if >

Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-02 Thread Stefan Hajnoczi
On Wed, May 2, 2012 at 9:20 AM, Kevin Wolf wrote: > Am 01.05.2012 22:25, schrieb Anthony Liguori: >> Thanks for sending this out Stefan. >> >> On 05/01/2012 10:31 AM, Stefan Hajnoczi wrote: >>> Libvirt can take advantage of SELinux to restrict the QEMU process and >>> prevent >>> it from opening

Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-02 Thread Kevin Wolf
Am 01.05.2012 22:25, schrieb Anthony Liguori: > Thanks for sending this out Stefan. > > On 05/01/2012 10:31 AM, Stefan Hajnoczi wrote: >> Libvirt can take advantage of SELinux to restrict the QEMU process and >> prevent >> it from opening files that it should not have access to. This improves >>

Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-01 Thread Anthony Liguori
On 05/01/2012 04:45 PM, Corey Bryant wrote: On 05/01/2012 04:25 PM, Anthony Liguori wrote: Thanks for sending this out Stefan. On 05/01/2012 10:31 AM, Stefan Hajnoczi wrote: Libvirt can take advantage of SELinux to restrict the QEMU process and prevent it from opening files that it should no

Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-01 Thread Corey Bryant
On 05/01/2012 04:25 PM, Anthony Liguori wrote: Thanks for sending this out Stefan. On 05/01/2012 10:31 AM, Stefan Hajnoczi wrote: Libvirt can take advantage of SELinux to restrict the QEMU process and prevent it from opening files that it should not have access to. This improves security beca

Re: [Qemu-devel] [RFC 0/5] block: File descriptor passing using -open-hook-fd

2012-05-01 Thread Anthony Liguori
Thanks for sending this out Stefan. On 05/01/2012 10:31 AM, Stefan Hajnoczi wrote: Libvirt can take advantage of SELinux to restrict the QEMU process and prevent it from opening files that it should not have access to. This improves security because it prevents the attacker from escaping the QE