Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

New profile: tqemu #6255

Merged
merged 1 commit into from
Mar 23, 2024
Merged

New profile: tqemu #6255

merged 1 commit into from
Mar 23, 2024

Conversation

glitsj16
Copy link
Collaborator

@glitsj16 glitsj16 commented Mar 2, 2024

tqemu

Description: QEMU frontend without libvirt.

https://github.com/thanoulis/tqemu

Copy link
Collaborator

@kmk3 kmk3 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why is the profile for a qemu wrapper in some cases more restrictive than the
profile for qemu itself (qemu-system-x86_64.profile)?

Suggestions:

  • Move the contents of qemu-system-x86_64.profile into qemu-common.profile
    and make the former (and qemu-launcher.profile) redirect to the latter
  • Make tqemu.profile redirect to qemu-common.profile
  • Harden qemu-common.profile (preferably in another PR as it may cause
    breakage for qemu itself)

@glitsj16
Copy link
Collaborator Author

Why is the profile for a qemu wrapper in some cases more restrictive than the
profile for qemu itself (qemu-system-x86_64.profile)?

AFAIK tqemu is the only such wrapper that doesn't rely on libvirt. It's more limited in its functionality, but that also makes it very straightforward to sandbox.

I'll need more time to refactor/double-check the qemu wrappers as you suggested. Thanks!

@kmk3
Copy link
Collaborator

kmk3 commented Mar 20, 2024

Why is the profile for a qemu wrapper in some cases more restrictive than
the profile for qemu itself (qemu-system-x86_64.profile)?

AFAIK tqemu is the only such wrapper that doesn't rely on libvirt. It's more
limited in its functionality, but that also makes it very straightforward to
sandbox.

That's good to know, but qemu itself does not use libvirt (it's essentially the
other way around).

My point was that in general it doesn't make much sense for a wrapper (tqemu)
to have a more restrictive profile than the thing that it is wrapping (qemu).

I'll need more time to refactor/double-check the qemu wrappers as you
suggested. Thanks!

On second though, for simplicity, I'd just copy and paste most of
qemu-system-x86_64.profile into tqemu.profile for now (so that they are
almost equal) and leave the refactoring/hardening for another PR.

@glitsj16
Copy link
Collaborator Author

On second though, for simplicity, I'd just copy and paste most of
qemu-system-x86_64.profile into tqemu.profile for now...

Done!

Description: QEMU frontend without libvirt.

https://github.com/thanoulis/tqemu
@kmk3 kmk3 merged commit 96d66fa into netblue30:master Mar 23, 2024
8 checks passed
kmk3 added a commit to kmk3/firejail that referenced this pull request Mar 23, 2024
Add a common profile to deduplicate entries and make qemu-related
profiles redirect to it.

Relates to netblue30#6255.
kmk3 added a commit to kmk3/firejail that referenced this pull request Mar 23, 2024
Add a common profile to deduplicate entries and make qemu-related
profiles redirect to it.

Relates to netblue30#6255.
@glitsj16 glitsj16 deleted the tqemu branch March 23, 2024 09:49
kmk3 added a commit that referenced this pull request Mar 25, 2024
Add a common profile to deduplicate entries and make qemu-related
profiles redirect to it.

Relates to #6255.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants