Re: [Xen-devel] [PATCH] docs/qemu-deprivilege: Revise and update with status and future plans

[Anthony PERARD <anthony.perard@xxxxxxxxxx>]

On Thu, Mar 22, 2018 at 06:24:37PM +0000, George Dunlap wrote:
> +### Disks
> +
> +The chroot (and seccomp?) happens late enough such that QEMU can
> +initialize itself and open its disks. If you want to add a disk at run
> +time via or insert a CD, you can't pass a path because QEMU is
> +chrooted. Instead use the add-fd QMP command and use
> +/dev/fdset/<fdset-id> as the path.
> +
> +A further layer of restriction could be to set RLIMIT_NOFILES to '0',
> +and hand all disks over QMP.

The "add-fd" can work also on the command line. But I guess using only
QMP will be better from libxl point of view, only one code path to add
disks.

Also, with dm_restrict=1, another todo: qdisk backend doesn't work. We
probably needs to start a second QEMU process for pv backends.

-- 
Anthony PERARD

_______________________________________________
Xen-devel mailing list
Xen-devel@xxxxxxxxxxxxxxxxxxxx
https://lists.xenproject.org/mailman/listinfo/xen-devel