Re: [Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-30 Thread Stefano Stabellini
On Tue, 30 Jun 2015, Ian Campbell wrote: # > On Tue, 2015-06-30 at 11:46 +0100, Stefano Stabellini wrote: > > I guess I could add a constant to libxl.h and use it in both libxl and > > xl? > > Yuk. I'd be more inclined to just drop the domain-name-specific user > functionality and leave just the

Re: [Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-30 Thread Ian Campbell
On Tue, 2015-06-30 at 11:46 +0100, Stefano Stabellini wrote: > I guess I could add a constant to libxl.h and use it in both libxl and > xl? Yuk. I'd be more inclined to just drop the domain-name-specific user functionality and leave just the per-domid one and catch all fallback. Ian. _

Re: [Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-30 Thread Stefano Stabellini
On Tue, 30 Jun 2015, Ian Campbell wrote: > On Mon, 2015-06-29 at 18:06 +0100, Stefano Stabellini wrote: > > On Thu, 25 Jun 2015, Ian Campbell wrote: > > > On Mon, 2015-06-01 at 17:46 +0100, Stefano Stabellini wrote: > > > > Try to use "xen-qemudepriv-$domname" first, then > > > > "xen-qemudepriv-do

Re: [Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-30 Thread Ian Campbell
On Mon, 2015-06-29 at 18:06 +0100, Stefano Stabellini wrote: > On Thu, 25 Jun 2015, Ian Campbell wrote: > > On Mon, 2015-06-01 at 17:46 +0100, Stefano Stabellini wrote: > > > Try to use "xen-qemudepriv-$domname" first, then > > > "xen-qemudepriv-domid$domid", finally "xen-qemudepriv-shared" and roo

Re: [Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-29 Thread Stefano Stabellini
On Thu, 25 Jun 2015, Ian Campbell wrote: > On Mon, 2015-06-01 at 17:46 +0100, Stefano Stabellini wrote: > > Try to use "xen-qemudepriv-$domname" first, then > > "xen-qemudepriv-domid$domid", finally "xen-qemudepriv-shared" and root > > if everything else fails. > > > > The uids need to be manually

Re: [Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-25 Thread Ian Campbell
On Mon, 2015-06-01 at 17:46 +0100, Stefano Stabellini wrote: > Try to use "xen-qemudepriv-$domname" first, then > "xen-qemudepriv-domid$domid", finally "xen-qemudepriv-shared" and root > if everything else fails. > > The uids need to be manually created by the user or, more likely, by the > xen pa

[Xen-devel] [PATCH v4] run QEMU as non-root

2015-06-01 Thread Stefano Stabellini
Try to use "xen-qemudepriv-$domname" first, then "xen-qemudepriv-domid$domid", finally "xen-qemudepriv-shared" and root if everything else fails. The uids need to be manually created by the user or, more likely, by the xen package maintainer. To actually secure QEMU when running in Dom0, we need