Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-07 Thread Corey Bryant
On 09/07/2012 08:06 AM, Daniel Veillard wrote: On Fri, Sep 07, 2012 at 01:29:25PM +0200, Ján Tomko wrote: On 09/07/12 05:25, Daniel Veillard wrote: The problem is that libvirt and qemu releases are a priori not tied, doing what you suggest would mean to try to guess the actual qemu versio

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-07 Thread Daniel Veillard
On Fri, Sep 07, 2012 at 01:29:25PM +0200, Ján Tomko wrote: > On 09/07/12 05:25, Daniel Veillard wrote: > > > > The problem is that libvirt and qemu releases are a priori not > > tied, doing what you suggest would mean to try to guess the actual > > qemu version used by the guest and then switch

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-07 Thread Ján Tomko
On 09/07/12 05:25, Daniel Veillard wrote: > > The problem is that libvirt and qemu releases are a priori not > tied, doing what you suggest would mean to try to guess the actual > qemu version used by the guest and then switch on or off, which would > somehow be at odd with the overall driver co

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-06 Thread Daniel Veillard
On Thu, Sep 06, 2012 at 11:53:06AM -0400, Corey Bryant wrote: > > > On 09/06/2012 02:45 AM, Daniel Veillard wrote: > >On Thu, Sep 06, 2012 at 02:27:19PM +0800, Daniel Veillard wrote: > >>On Mon, Sep 03, 2012 at 02:03:39PM +0200, Ján Tomko wrote: > >>>QEMU (since 1.2-rc0) supports setting up a sys

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-06 Thread Daniel Veillard
On Mon, Sep 03, 2012 at 02:03:39PM +0200, Ján Tomko wrote: > QEMU (since 1.2-rc0) supports setting up a syscall whitelist through > libseccomp on linux kernel from 3.5-rc1. This is enabled by specifying > -sandbox on on qemu command line. > > This patch detects this capability by searching for -sa

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-06 Thread Corey Bryant
On 09/06/2012 02:27 AM, Daniel Veillard wrote: On Mon, Sep 03, 2012 at 02:03:39PM +0200, Ján Tomko wrote: QEMU (since 1.2-rc0) supports setting up a syscall whitelist through libseccomp on linux kernel from 3.5-rc1. This is enabled by specifying -sandbox on on qemu command line. This patch de

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-06 Thread Corey Bryant
On 09/06/2012 02:45 AM, Daniel Veillard wrote: On Thu, Sep 06, 2012 at 02:27:19PM +0800, Daniel Veillard wrote: On Mon, Sep 03, 2012 at 02:03:39PM +0200, Ján Tomko wrote: QEMU (since 1.2-rc0) supports setting up a syscall whitelist through libseccomp on linux kernel from 3.5-rc1. This is enab

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-05 Thread Daniel Veillard
On Thu, Sep 06, 2012 at 02:27:19PM +0800, Daniel Veillard wrote: > On Mon, Sep 03, 2012 at 02:03:39PM +0200, Ján Tomko wrote: > > QEMU (since 1.2-rc0) supports setting up a syscall whitelist through > > libseccomp on linux kernel from 3.5-rc1. This is enabled by specifying > > -sandbox on on qemu c

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-05 Thread Daniel Veillard
On Mon, Sep 03, 2012 at 02:03:39PM +0200, Ján Tomko wrote: > QEMU (since 1.2-rc0) supports setting up a syscall whitelist through > libseccomp on linux kernel from 3.5-rc1. This is enabled by specifying > -sandbox on on qemu command line. > > This patch detects this capability by searching for -sa

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-04 Thread Eric Blake
On 09/03/2012 03:07 PM, Doug Goldstein wrote: > On Mon, Sep 3, 2012 at 7:03 AM, Ján Tomko wrote: >> QEMU (since 1.2-rc0) supports setting up a syscall whitelist through >> libseccomp on linux kernel from 3.5-rc1. This is enabled by specifying >> -sandbox on on qemu command line. > > > > There's

Re: [libvirt] [PATCH v0] qemu: Add sandbox support.

2012-09-03 Thread Doug Goldstein
On Mon, Sep 3, 2012 at 7:03 AM, Ján Tomko wrote: > QEMU (since 1.2-rc0) supports setting up a syscall whitelist through > libseccomp on linux kernel from 3.5-rc1. This is enabled by specifying > -sandbox on on qemu command line. There's a big push to not rely on -help scraping, please work with