Hi,
On 09/15/2011 06:45 PM, Frédéric Grelot wrote:
hi Hans,
Instead of using a privileged helper, wouldn't it be better to do it just like
another virtualization solution (from the society that also licences a
very-well known object-oriented programming language) does : create a special
user group, add an udev rule that associates that group to the devices in
/dev/bus/usb as they get plugged, and thus allow people of that group to use
usb devices transparently?
Of course, the main problem that it raises is that it will break that other
virtualization solution's, since devices cannot be assigned to 2 different user
groups...
The problem with using a group for this, is that it will require admin
intervention to make things work. We want this to "just" work for
anyone who does a fresh install of a distro, and then creates
a virtual machine using for example virt-manager.
Using a privileged helper + policykit allows us to offer such a
"just" works experience, where as using a unix group does not.
Regards,
hans
Frederic.
----- Mail original -----
Hi,
Currently when people want to use usbredirection to a virtual machine
from
spice-client, they must launch the spice-client as root so that it
can
access device nodes under /dev/bus/usb.
Since the purpose is for usbredirection to just work plug and play
for
virtual machines, this needs to change.
My plan is to write a (privileged) helper program which will:
1) Check if it is invoked from a console session (using ConsoleKit
or the new ConsoleKit equivalent functionality in systemd in
F-16)
2) Poke PolicyKit asking it if it is ok for the user to get access
to raw usb devices
3) Do something to actually open up the device to the spice-client,
there are 2 options:
a) relax permissions (set an acl)
b) open the device node and hand over a fd, but since I'm using
libusb
to access the device nodes this is not really an option, leaving
only a.
3) Is a part where I've some systemd/udev questions about. Currently
udev already does similar opening up of acl's for the active console
user for things like soundcards, etc. I wonder if somehow I could
hook
into udev to make use of this for the usb device nodes (after having
done the policykit tests?
Thanks& Regards,
Hans
_______________________________________________
Spice-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/spice-devel
_______________________________________________
Spice-devel mailing list
[email protected]
http://lists.freedesktop.org/mailman/listinfo/spice-devel
