Re: [Qemu-devel] [PATCH 0/4] net-bridge: rootless bridge support for qemu

[Anthony Liguori]

Avi Kivity wrote:
> On 11/05/2009 05:11 PM, Avi Kivity wrote:
> > But we're forcing our style of security management on them.  How to 
> > store permissions is the management system's job (and for a clu^Houd, 
> > it will typically be stored in a central database, not be scattered 
> > around /etc).
> >
> > Again, IMO we should stick to making a guest work, and leave all the 
> > glue to management.
>
> As an example of why this is so, if the management stack wants to 
> configure the tap interface further (say, add some ebtables rules 
> guarding the new interface) it must push this into qemu or stop using 
> -net bridge.

If you wanted to set rules based on the tap device itself, then yes.  
But I think the more common case (honestly, the only case I've seen so 
far) is where the rules are set on the bridge itself.

> Having the tap accessible to management also allows it to run tcpdump 
> or collect statistics on it at runtime.

I'm not advocating removing -net tap,fd=.  But -net bridge is obviously 
useful and makes writing management tools that do common things easier.  
Not doing something that helps management tools and command line users 
tremendously simply because it's possible to do it another way for 
management tools (but not for command line users) is almost user hostile.

--
Regards,

Anthony Liguori