Features/HelperNetworking: Difference between revisions

From QEMU
mNo edit summary
mNo edit summary
Line 17: Line 17:
A default network helper is introduced that implements the same functionality as the common qemu-ifup script.  It creates a tap file descriptor, attaches it to a bridge, and passes it back to QEMU.  This helper runs with higher privileges and allows QEMU to be invoked as a non-privileged user.  (The helper runs as setuid root and privileges are immediately dropped to cap_net_admin.)
A default network helper is introduced that implements the same functionality as the common qemu-ifup script.  It creates a tap file descriptor, attaches it to a bridge, and passes it back to QEMU.  This helper runs with higher privileges and allows QEMU to be invoked as a non-privileged user.  (The helper runs as setuid root and privileges are immediately dropped to cap_net_admin.)


The default network helper uses it's own ACL mechanism for access control.  Administrators can restrict the bridges that an unprivileged user can put a guest on (ie. what should be isolated networks).  A future network helper could be developed to support PolicyKit for access control.
The default network helper uses it's own ACL mechanism for access control.  Administrators can restrict the bridges that an unprivileged user can put a guest on.  A future network helper could be developed to support PolicyKit for access control.


== Setup ==
== Setup ==
Line 26: Line 26:
ACLs must be implemented for the default network helper.  The ACL mechanism that is enforced by qemu-bridge-helper is a fairly simple whitelist/blacklist mechanisms with a wildcard of 'all'.  All users are blacklisted by default, and deny takes precedence over allow.
ACLs must be implemented for the default network helper.  The ACL mechanism that is enforced by qemu-bridge-helper is a fairly simple whitelist/blacklist mechanisms with a wildcard of 'all'.  All users are blacklisted by default, and deny takes precedence over allow.


As an example:
The minimum required to run the default helper with the default bridge br0 is:


/etc/qemu/bridge.conf root:qemu 0640
/etc/qemu/bridge.conf root:qemu 0640


  allow br0
  allow br0
include /etc/qemu/alice.conf
include /etc/qemu/bob.conf
include /etc/qemu/charlie.conf
/etc/qemu/alice.conf root:alice 0640
allow br1
/etc/qemu/bob.conf root:bob 0640
allow br2
/etc/qemu/charlie.conf root:charlie 0640
deny all
This ACL pattern allows any user in the qemu group to get a tap device connected to br0 (which is bridged to the physical network).
Users in the alice group can additionally get a tap device connected to br1.  This allows br1 to act as a private bridge for the alice group.
Users in the bob group can additionally get a tap device connected to br2.  This allows br2 to act as a private bridge for the bob group.
Users in the charlie group cannot get a tap device connected to any bridge.
Under no circumstance can the bob group get access to br1 or can the alice group get access to br2.  And under no cicumstance can the charlie group get access to any bridge.


== Execution ==
== Execution ==
The following examples run Qemu with the default network helper, attaching a tap device to the default br0 bridge:
The following examples run Qemu with the default network helper and default bridge br0:
 
    qemu linux.img -net bridge -net nic,model=virtio
 
    qemu linux.img -net tap,helper=/usr/local/libexec/qemu-bridge-helper -net nic,model=virtio


     qemu linux.img -netdev bridge,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1
     qemu linux.img -netdev bridge,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1
Line 66: Line 40:


== Status ==
== Status ==
 
* Patches are in review on the mailing list.
* http://www.mail-archive.com/qemu-devel@nongnu.org/msg90423.html
* Latest version of patches: http://www.mail-archive.com/qemu-devel@nongnu.org/msg90423.html

Revision as of 15:04, 22 December 2011


Summary

Introduce infrastructure to allowed QEMU network backends to be implemented outside of QEMU in a generic way.

Owner

Detailed Summary

Infrastructure is introduced to enable a network helper to be executed by QEMU. This also allows third parties to implement user-visible network backends without having to introduce them into QEMU itself.

A default network helper is introduced that implements the same functionality as the common qemu-ifup script. It creates a tap file descriptor, attaches it to a bridge, and passes it back to QEMU. This helper runs with higher privileges and allows QEMU to be invoked as a non-privileged user. (The helper runs as setuid root and privileges are immediately dropped to cap_net_admin.)

The default network helper uses it's own ACL mechanism for access control. Administrators can restrict the bridges that an unprivileged user can put a guest on. A future network helper could be developed to support PolicyKit for access control.

Setup

The setuid attribute needs to be turned on for the default network helper:

   sudo chmod u+s /usr/local/libexec/qemu-bridge-helper

ACLs must be implemented for the default network helper. The ACL mechanism that is enforced by qemu-bridge-helper is a fairly simple whitelist/blacklist mechanisms with a wildcard of 'all'. All users are blacklisted by default, and deny takes precedence over allow.

The minimum required to run the default helper with the default bridge br0 is:

/etc/qemu/bridge.conf root:qemu 0640

allow br0

Execution

The following examples run Qemu with the default network helper and default bridge br0:

   qemu linux.img -netdev bridge,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1
   qemu linux.img -netdev tap,helper=/usr/local/libexec/qemu-bridge-helper,id=hn0 -device virtio-net-pci,netdev=hn0,id=nic1

Status