Re: [Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-24 Thread Stefan Hajnoczi
On Mon, Oct 23, 2017 at 03:30:05PM +0100, Ross Lagerwall wrote: > On 10/19/2017 05:24 PM, Daniel P. Berrange wrote: > > On Thu, Oct 19, 2017 at 05:04:19PM +0100, Ross Lagerwall wrote: > > > Add an option to allow calling unshare() just before starting guest > > > execution. The option allows unshar

Re: [Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-23 Thread Daniel P. Berrange
On Mon, Oct 23, 2017 at 04:01:12PM +0100, Ross Lagerwall wrote: > On 10/23/2017 03:50 PM, Daniel P. Berrange wrote: > > On Mon, Oct 23, 2017 at 03:30:05PM +0100, Ross Lagerwall wrote: > > > On 10/19/2017 05:24 PM, Daniel P. Berrange wrote: > > > > On Thu, Oct 19, 2017 at 05:04:19PM +0100, Ross Lage

Re: [Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-23 Thread Ross Lagerwall
On 10/23/2017 03:50 PM, Daniel P. Berrange wrote: On Mon, Oct 23, 2017 at 03:30:05PM +0100, Ross Lagerwall wrote: On 10/19/2017 05:24 PM, Daniel P. Berrange wrote: On Thu, Oct 19, 2017 at 05:04:19PM +0100, Ross Lagerwall wrote: Add an option to allow calling unshare() just before starting gues

Re: [Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-23 Thread Daniel P. Berrange
On Mon, Oct 23, 2017 at 03:30:05PM +0100, Ross Lagerwall wrote: > On 10/19/2017 05:24 PM, Daniel P. Berrange wrote: > > On Thu, Oct 19, 2017 at 05:04:19PM +0100, Ross Lagerwall wrote: > > > Add an option to allow calling unshare() just before starting guest > > > execution. The option allows unshar

Re: [Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-23 Thread Ross Lagerwall
On 10/19/2017 05:24 PM, Daniel P. Berrange wrote: On Thu, Oct 19, 2017 at 05:04:19PM +0100, Ross Lagerwall wrote: Add an option to allow calling unshare() just before starting guest execution. The option allows unsharing one or more of the mount namespace, the network namespace, and the IPC name

Re: [Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-19 Thread Daniel P. Berrange
On Thu, Oct 19, 2017 at 05:04:19PM +0100, Ross Lagerwall wrote: > Add an option to allow calling unshare() just before starting guest > execution. The option allows unsharing one or more of the mount > namespace, the network namespace, and the IPC namespace. This is useful > to restrict the ability

[Qemu-devel] [PATCH v1] os-posix: Add -unshare option

2017-10-19 Thread Ross Lagerwall
Add an option to allow calling unshare() just before starting guest execution. The option allows unsharing one or more of the mount namespace, the network namespace, and the IPC namespace. This is useful to restrict the ability of QEMU to cause damage to the system should it be compromised. An exa