Re: A few KVM security questions

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

 



Avi Kivity wrote:
No. Paravirtualization just augments the standard hardware interface, it doesn't replace it as in Xen.

NB, unlike Xen, we can (and do) run qemu as non-root. Things like RHEV-H and oVirt constrain the qemu process with SELinux.

Also, you can use qemu to provide the backends to a Xen PV guest (see -M xenpv). The effect is that you are moving that privileged code from the kernel (netback/blkback) to userspace (qemu -M xenpv).

In general, KVM tends to keep code in userspace unless absolutely necessary. That's a fundamental difference from Xen which tends to do the opposite.

Regards,

Anthony Liguori
--
To unsubscribe from this list: send the line "unsubscribe kvm" in
the body of a message to majordomo@xxxxxxxxxxxxxxx
More majordomo info at  http://vger.kernel.org/majordomo-info.html

[Index of Archives]     [KVM ARM]     [KVM ia64]     [KVM ppc]     [Virtualization Tools]     [Spice Development]     [Libvirt]     [Libvirt Users]     [Linux USB Devel]     [Linux Audio Users]     [Yosemite Questions]     [Linux Kernel]     [Linux SCSI]     [XFree86]
  Powered by Linux