This is an archived copy of the Xen.org mailing list, which we have preserved to ensure that existing links to archives are not broken. The live archive, which contains the latest emails, can be found at http://lists.xen.org/
Home Products Support Community News


Re: [Xen-devel] PATCH: Set close-on-exec flag for QEMU disks

To: Keir Fraser <keir@xxxxxxxxxxxxx>
Subject: Re: [Xen-devel] PATCH: Set close-on-exec flag for QEMU disks
From: Anthony Liguori <aliguori@xxxxxxxxxx>
Date: Mon, 05 Mar 2007 15:23:43 -0600
Cc: xen-devel@xxxxxxxxxxxxxxxxxxx, "Daniel P. Berrange" <berrange@xxxxxxxxxx>
Delivery-date: Mon, 05 Mar 2007 13:25:31 -0800
Envelope-to: www-data@xxxxxxxxxxxxxxxxxx
In-reply-to: <C211CAC3.A969%keir@xxxxxxxxxxxxx>
List-help: <mailto:xen-devel-request@lists.xensource.com?subject=help>
List-id: Xen developer discussion <xen-devel.lists.xensource.com>
List-post: <mailto:xen-devel@lists.xensource.com>
List-subscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=subscribe>
List-unsubscribe: <http://lists.xensource.com/cgi-bin/mailman/listinfo/xen-devel>, <mailto:xen-devel-request@lists.xensource.com?subject=unsubscribe>
References: <C211CAC3.A969%keir@xxxxxxxxxxxxx>
Sender: xen-devel-bounces@xxxxxxxxxxxxxxxxxxx
User-agent: Thunderbird (X11/20070103)
Keir Fraser wrote:
On 2/3/07 21:40, "Daniel P. Berrange" <berrange@xxxxxxxxxx> wrote:

QEMU does not currently set the close-on-exec flag after opening its virtual
disk images. This causes problems when it later runs the /etc/xen/qemu-ifup
script because the file descriptors get propagated to networking commands
like brctl / ifconfig. The SELinux policy quite rightly does not allow the
networking scripts to access the virtual disk images, so these inherited
file descriptors for AVC denials to be logged.

The attached patch modifies all the QEMU disk driver backends to make sure
the close-on-exec flag is turned on

It would be nicer to implement an open_cloexec() function in e.g., vl.c to
do the open() and fcntl() in one go and in one place.

There are few areas where scripts are executed. Why not just introduce an exec() wrapper that closes file descriptors appropriately.

That makes it less likely that this problem will occur in the future.


Anthony Liguori

There are lots of uses of open() throughout the qemu sources and the patch
only fixes up a subset of them -- is this correct?

 -- Keir

Xen-devel mailing list

Xen-devel mailing list

<Prev in Thread] Current Thread [Next in Thread>