« Previous | Next » 

Revision 47e98658

ID47e98658f58b8afd319851f44edcb81f2d2d3774

Added by Corey Bryant about 12 years ago

Add cap reduction support to enable use as SUID

The ideal way to use qemu-bridge-helper is to give it an fscap of using:

setcap cap_net_admin=ep qemu-bridge-helper

Unfortunately, most distros still do not have a mechanism to package files
with fscaps applied. This means they'll have to SUID the qemu-bridge-helper
binary.

To improve security, use libcap to reduce our capability set to just
cap_net_admin, then reduce privileges down to the calling user. This is
hopefully close to equivalent to fscap support from a security perspective.

Signed-off-by: Anthony Liguori <>
Signed-off-by: Richa Marwaha <>
Signed-off-by: Corey Bryant <>
Signed-off-by: Anthony Liguori <>

Files

  • added
  • modified
  • copied
  • renamed
  • deleted

View differences