On Mon, Dec 15, 2008 at 05:08:29PM -0600, Anthony Liguori (anthony@xxxxxxxxxxxxx) wrote: > The KVM model is that a guest is a process. Any IO operations original > from the process (QEMU). The advantage to this is that you get very > good security because you can use things like SELinux and simply treat > the QEMU process as you would the guest. In fact, in general, I think > we want to assume that QEMU is guest code from a security perspective. > > By passing up the network traffic to the host kernel, we now face a > problem when we try to get the data back. We could setup a tun device > to send traffic to the kernel but then the rest of the system can see > that traffic too. If that traffic is sensitive, it's potentially unsafe. You can even use unix sockets in this case, and each socket will be named as virtio channels names. IIRC tun/tap devices can be virtualizen with recent kernels, which also solves all problems of shared access. There are plenty of ways to implement this kind of functionality instead of developing some new protocol, which is effectively a duplication of what already exists in the kernel. -- Evgeniy Polyakov _______________________________________________ Virtualization mailing list Virtualization@xxxxxxxxxxxxxxxxxxxxxxxxxx https://lists.linux-foundation.org/mailman/listinfo/virtualization
