diff options
| author | Corey Bryant <coreyb@linux.vnet.ibm.com> | 2012-01-26 09:42:26 -0500 |
|---|---|---|
| committer | Anthony Liguori <aliguori@us.ibm.com> | 2012-02-01 16:24:39 -0600 |
| commit | 47e98658f58b8afd319851f44edcb81f2d2d3774 (patch) | |
| tree | f40e9ae17206142321353526f2b84d8579406ba3 /hw/usb-net.c | |
| parent | bdef79a2994d6f0383e07e9597675711662b3031 (diff) | |
| download | focaccia-qemu-47e98658f58b8afd319851f44edcb81f2d2d3774.tar.gz focaccia-qemu-47e98658f58b8afd319851f44edcb81f2d2d3774.zip | |
Add cap reduction support to enable use as SUID
The ideal way to use qemu-bridge-helper is to give it an fscap of using: setcap cap_net_admin=ep qemu-bridge-helper Unfortunately, most distros still do not have a mechanism to package files with fscaps applied. This means they'll have to SUID the qemu-bridge-helper binary. To improve security, use libcap to reduce our capability set to just cap_net_admin, then reduce privileges down to the calling user. This is hopefully close to equivalent to fscap support from a security perspective. Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> Signed-off-by: Richa Marwaha <rmarwah@linux.vnet.ibm.com> Signed-off-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
Diffstat (limited to 'hw/usb-net.c')
0 files changed, 0 insertions, 0 deletions