[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH 0/4] net-bridge: rootless bridge support for qem

From: Anthony Liguori
Subject: Re: [Qemu-devel] [PATCH 0/4] net-bridge: rootless bridge support for qemu
Date: Thu, 05 Nov 2009 09:58:52 -0600
User-agent: Thunderbird (X11/20090825)

Avi Kivity wrote:
On 11/05/2009 05:11 PM, Avi Kivity wrote:
But we're forcing our style of security management on them. How to store permissions is the management system's job (and for a clu^Houd, it will typically be stored in a central database, not be scattered around /etc).

Again, IMO we should stick to making a guest work, and leave all the glue to management.

As an example of why this is so, if the management stack wants to configure the tap interface further (say, add some ebtables rules guarding the new interface) it must push this into qemu or stop using -net bridge.

If you wanted to set rules based on the tap device itself, then yes. But I think the more common case (honestly, the only case I've seen so far) is where the rules are set on the bridge itself.

Having the tap accessible to management also allows it to run tcpdump or collect statistics on it at runtime.

I'm not advocating removing -net tap,fd=. But -net bridge is obviously useful and makes writing management tools that do common things easier. Not doing something that helps management tools and command line users tremendously simply because it's possible to do it another way for management tools (but not for command line users) is almost user hostile.


Anthony Liguori

reply via email to

[Prev in Thread] Current Thread [Next in Thread]