Re: [Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID

2011-10-06 Thread Corey Bryant
On 10/06/2011 01:42 PM, Anthony Liguori wrote: On 10/06/2011 11:34 AM, Daniel P. Berrange wrote: On Thu, Oct 06, 2011 at 11:38:27AM -0400, Richa Marwaha wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately,

Re: [Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID

2011-10-06 Thread Corey Bryant
On 10/06/2011 01:42 PM, Anthony Liguori wrote: On 10/06/2011 11:34 AM, Daniel P. Berrange wrote: On Thu, Oct 06, 2011 at 11:38:27AM -0400, Richa Marwaha wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately,

Re: [Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID

2011-10-06 Thread Anthony Liguori
On 10/06/2011 11:34 AM, Daniel P. Berrange wrote: On Thu, Oct 06, 2011 at 11:38:27AM -0400, Richa Marwaha wrote: The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to pa

Re: [Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID

2011-10-06 Thread Daniel P. Berrange
On Thu, Oct 06, 2011 at 11:38:27AM -0400, Richa Marwaha wrote: > The ideal way to use qemu-bridge-helper is to give it an fscap of using: > > setcap cap_net_admin=ep qemu-bridge-helper > > Unfortunately, most distros still do not have a mechanism to package files > with fscaps applied. This mea

[Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID

2011-10-06 Thread Richa Marwaha
The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve security

[Qemu-devel] [PATCH 3/4] Add cap reduction support to enable use as SUID binary

2009-11-03 Thread Anthony Liguori
The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve security