Features/HelperNetworking: Difference between revisions
No edit summary |
|||
| Line 13: | Line 13: | ||
== Detailed Summary == | == Detailed Summary == | ||
A network helper is introduced that can be invoked to create appropriate file descriptors and pass them back to QEMU. This helper runs with higher privilegs, allowing QEMU to attach a tap device to a bridge, while being invoked as a non-privileged user. This also allows third parties to implement user-visible network backends without having to introduce them into QEMU itself. The helper that is provided could just as easily be run by libvirt, and the open fd passed to QEMU over the -net tap,fd= option. | A network helper (and supporting infrastructure) is introduced that can be invoked to create appropriate file descriptors and pass them back to QEMU. This helper runs with higher privilegs, allowing QEMU to attach a tap device to a bridge, while being invoked as a non-privileged user. This also allows third parties to implement user-visible network backends without having to introduce them into QEMU itself. The helper that is provided could just as easily be run by libvirt, and the open fd passed to QEMU over the -net tap,fd= option. | ||
== Network Helper == | == Network Helper == | ||
Revision as of 21:02, 21 December 2011
Summary
Introduce infrastructure to allowed QEMU network backends to be implemented outside of QEMU in a generic way.
Owner
- Name: Anthony Liguori
- Email: anthony@codemonkey.ws
- Name: Corey Bryant
- Email: coreyb@linux.vnet.ibm.com
- Name: Richa Marwaha
- Email: rmarwah@linux.vnet.ibm.com
Detailed Summary
A network helper (and supporting infrastructure) is introduced that can be invoked to create appropriate file descriptors and pass them back to QEMU. This helper runs with higher privilegs, allowing QEMU to attach a tap device to a bridge, while being invoked as a non-privileged user. This also allows third parties to implement user-visible network backends without having to introduce them into QEMU itself. The helper that is provided could just as easily be run by libvirt, and the open fd passed to QEMU over the -net tap,fd= option.
Network Helper
With the help of qemu_network_helper, an unprivileged user can configure the TAP interface which connects to a bridge. The helper can be invoked by using the br{bridge name} and helper{executable to configure the bridge} options in -net tap or by using -net bridge option which by default invokes br and helper options. The default helper implements the most common qemu-ifup script that can be safely given cap_net_admin.
Currently helper uses it's own ACL mechanism for access control as default,but future network helpers could be developed, for example, to support PolicyKit for access control.
Examples
The following examples run Qemu with the default network helper, attaching a tap device to the default br0 bridge:
qemu linux.img -net bridge -net nic,model=virtio
qemu linux.img -net tap,helper=/usr/local/libexec/qemu-bridge-helper -net nic,model=virtio
qemu linux.img -netdev bridge,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1
qemu linux.img -netdev tap,helper=/usr/local/libexec/qemu-bridge-helper,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1