1. 07 2月, 2012 13 次提交
  2. 04 2月, 2012 24 次提交
  3. 02 2月, 2012 3 次提交
    • S
      Change license from GPLv2 to GPLv2+ · 4c32fe66
      Stefan Weil 提交于
      This file only contains code from Red Hat, so it can use GPLv2+.
      Tested with `git blame -M -C net/checksum.c`.
      Signed-off-by: NStefan Weil <sw@weilnetz.de>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      4c32fe66
    • C
      Add support for net bridge · a7c36ee4
      Corey Bryant 提交于
      The most common use of -net tap is to connect a tap device to a bridge.  This
      requires the use of a script and running qemu as root in order to allocate a
      tap device to pass to the script.
      
      This model is great for portability and flexibility but it's incredibly
      difficult to eliminate the need to run qemu as root.  The only really viable
      mechanism is to use tunctl to create a tap device, attach it to a bridge as
      root, and then hand that tap device to qemu.  The problem with this mechanism
      is that it requires administrator intervention whenever a user wants to create
      a guest.
      
      By essentially writing a helper that implements the most common qemu-ifup
      script that can be safely given cap_net_admin, we can dramatically simplify
      things for non-privileged users.  We still support existing -net tap options
      as a mechanism for advanced users and backwards compatibility.
      
      Currently, this is very Linux centric but there's really no reason why it
      couldn't be extended for other Unixes.
      
      A typical invocation would be similar to one of the following:
      
        qemu linux.img -net bridge -net nic,model=virtio
      
        qemu linux.img -net tap,helper="/usr/local/libexec/qemu-bridge-helper"
                       -net nic,model=virtio
      
        qemu linux.img -netdev bridge,id=hn0
                       -device virtio-net-pci,netdev=hn0,id=nic1
      
        qemu linux.img -netdev tap,helper="/usr/local/libexec/qemu-bridge-helper",id=hn0
                       -device virtio-net-pci,netdev=hn0,id=nic1
      
      The default bridge that we attach to is br0.  The thinking is that a distro
      could preconfigure such an interface to allow out-of-the-box bridged networking.
      
      Alternatively, if a user wants to use a different bridge, a typical invocation
      would be simliar to one of the following:
      
        qemu linux.img -net bridge,br=qemubr0 -net nic,model=virtio
      
        qemu linux.img -net tap,helper="/usr/local/libexec/qemu-bridge-helper --br=qemubr0"
                       -net nic,model=virtio
      
        qemu linux.img -netdev bridge,br=qemubr0,id=hn0
                       -device virtio-net-pci,netdev=hn0,id=nic1
      
        qemu linux.img -netdev tap,helper="/usr/local/libexec/qemu-bridge-helper --br=qemubr0",id=hn0
                       -device virtio-net-pci,netdev=hn0,id=nic1
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      Signed-off-by: NRicha Marwaha <rmarwah@linux.vnet.ibm.com>
      Signed-off-by: NCorey Bryant <coreyb@linux.vnet.ibm.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      a7c36ee4
    • C
      Add cap reduction support to enable use as SUID · 47e98658
      Corey Bryant 提交于
      The ideal way to use qemu-bridge-helper is to give it an fscap of using:
      
       setcap cap_net_admin=ep qemu-bridge-helper
      
      Unfortunately, most distros still do not have a mechanism to package files
      with fscaps applied.  This means they'll have to SUID the qemu-bridge-helper
      binary.
      
      To improve security, use libcap to reduce our capability set to just
      cap_net_admin, then reduce privileges down to the calling user.  This is
      hopefully close to equivalent to fscap support from a security perspective.
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      Signed-off-by: NRicha Marwaha <rmarwah@linux.vnet.ibm.com>
      Signed-off-by: NCorey Bryant <coreyb@linux.vnet.ibm.com>
      Signed-off-by: NAnthony Liguori <aliguori@us.ibm.com>
      47e98658