[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Re: KVM networking.

Thank You for Your time and answer, Arno:

>> /usr/bin/kvm -localtime -m 256 -no-reboot
>> -cdrom ./debian-
>> -boot d -hda ./da -net nic -net tap,ifname=tap0,script=no
>> kvm: -net tap,ifname=tap0,script=no: could not configure /dev/net/tun
>> (tap0): Operation not permitted
>Apparently, you need root access to create tap interfaces regardless
>of the permissions on the tap device. I have it on good authority
>(http://bugs.debian.org/630701#10) that the preferred way is to
>precreate the tapX interfaces in /etc/network/interfaces.

That's why I did include all the possible related commands (in the
up/down scripts of KVM) into sudoers file for the user.

$ ls -l /dev/net/tun
crw-rw-rw- 1 root root 10, 200 Nov  6 21:23 /dev/net/tun

- also should be OK...

>But if you are like me and you manage multiple virtual machines and you
>stubbornly insist on using dynamic tap interfaces, you can work around
>this by setting the CAP_NET_ADMIN capability on kvm:
># setcap cap_net_admin+ep /usr/bin/kvm
>However, there are two problems with this:
>- every time dpkg upgrades qemu, the capability gets reset
>- this is INSECURE, because you're now granting all your users full
>  access to your network interfaces. Only do this if you trust your
>  users.

I want to make it secure and update independent, let's look may some on
the list will share his/her knowledge w/ us - I do not believe all who
use the standard VM-ing make such work arounds. In the KVM manual it is
clearly written what to do in every case the network one would use -
just a workstation Internet access, bridges (private/public), and
tapped w/ latter routing for the interface.

For me it does not work for the following reasons:

1. The bridges take the Internet connections for itself - thus leaving
the host app.s w/o Internet access, probably routing needed here - but
they do not make any specifications for that.

2. As a workstation - it does not provide access from host to the guest.

3. W/ tap - You have seen already the problem - some unknown to me
permission problem - do You know why is it so? Or may have an idea
what else command I have to add to sudoers file for the user or some
other way by root specify the interface parameters that the user has to
use the interface w/?

>> user   ALL = /sbin/ifconfig *, /sbin/ifup br0, /sbin/ifdown
>> br0, /sbin/ip *, /sbin/brctl *, /sbin/tunctl *
>If you precreate the tap interface, you won't need these...

It left from other trials for bridges. I would leave it as it is now
until I will accomplish my goal - then I'll narrow the range of the
allowed or remove it at all - depending on the solution I will work out.

Reply to: