Libvirt, Xen PV, Qemu-system-i386, Root User

Home » CentOS-Virt » Libvirt, Xen PV, Qemu-system-i386, Root User
CentOS-Virt 7 Comments

Hi, after migrating to libvirt/libxl according to:

https://wiki.CentOS.org/HowTos/Xen/Xen4QuickStart/Xen4Libvirt

I’ve noticed that my Xen PV domains are being launched by qemu-system-i386 running under root privileges.

I am wondering why is this? Previously no qemu process was used.

If qemu is needed for some reason, are there any guidelines for non-root operation?

Thanks

7 thoughts on - Libvirt, Xen PV, Qemu-system-i386, Root User

  • Hi,

    In general qemu is used for the following purposes:

    – for certain domU disk backend types (image files), and/or if there’s no blktap driver in dom0 kernel.
    – domU graphical console (PVFB) VNC server, if it’s enabled for the domU.

    — Pasi

  • …

    changing from: to: makes the domain start without QEMU.

    However I see much better performance with QEMU (close to dom0, tested using simple dd writes) than with tap2 driver. Is that expected?

    What’s best practise to file based storage on latest CentOS6-xen (Kernel
    3.18.17, Xen 4.4.2-7)

    Are there any guides around running QEMU on CentOS6-xen as non-root user?

    Cheers

  • Comparing simple dd bs=1M count=10000 on dom0 vs domU. Qemu driver is achieving pretty much the same like dom0. Thanks

  • So you’re measuring buffered speed. Try measuring non-buffered (iflag=direct or oflag=direct, depending if you’re reading or writing).

    — Pasi

  • Good test, non-buffered dom0 dd write speed is similar with tap2.

    I’ll likely stay with the QEMU backend. Are there any best practises regarding security, at least if QEMU can operate under non-root account?

    Cheers

  • Not at the moment. Fortunately the attack surface from guest -> qemu in this case is fairly small (just the PV block interface).

    qemu deprivileging is on our short list of things to look at though. We’ve already had patches for deprivileging qemu when acting as a stub domain; those will probably make it for 4.7. I’ll add qdisk to the list.

    If you really want to get your hands dirty you could try to set up a storage driver domain; but that’s really not as simple to set up as it should be.

    Hope that helps.

    -George