One Hat Cyber Team

Edit File: dbus.html

<!DOCTYPE html>

 <html class="no-js" lang="en" > 
<head>
  <meta charset="utf-8">
  
  <meta name="viewport" content="width=device-width, initial-scale=1.0">
  
  <title>D-Bus &mdash; QEMU qemu-kvm-6.2.0-53.module+el8.10.0+2055+8eb7870b.4 documentation</title>

</head>

<a href="../index.html" class="icon icon-home"> QEMU

</div>

<div class="wy-menu wy-menu-vertical" data-spy="affix" role="navigation" aria-label="main navigation">
          
            
            
              
            
            
              <p class="caption"><span class="caption-text">Contents:</span></p>
<ul class="current">
<li class="toctree-l1"><a class="reference internal" href="../about/index.html">About QEMU</a></li>
<li class="toctree-l1"><a class="reference internal" href="../system/index.html">System Emulation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../user/index.html">User Mode Emulation</a></li>
<li class="toctree-l1"><a class="reference internal" href="../tools/index.html">Tools</a></li>
<li class="toctree-l1 current"><a class="reference internal" href="index.html">System Emulation Management and Interoperability</a><ul class="current">
<li class="toctree-l2"><a class="reference internal" href="barrier.html">Barrier client protocol</a></li>
<li class="toctree-l2"><a class="reference internal" href="bitmaps.html">Dirty Bitmaps and Incremental Backup</a></li>
<li class="toctree-l2 current"><a class="current reference internal" href="#">D-Bus</a><ul>
<li class="toctree-l3"><a class="reference internal" href="#introduction">Introduction</a></li>
<li class="toctree-l3"><a class="reference internal" href="#security">Security</a><ul>
<li class="toctree-l4"><a class="reference internal" href="#dbus-daemon-policy">dbus-daemon policy</a></li>
</ul>
</li>
<li class="toctree-l3"><a class="reference internal" href="#guidelines">Guidelines</a></li>
<li class="toctree-l3"><a class="reference internal" href="#qemu-interfaces">QEMU Interfaces</a></li>
</ul>
</li>
<li class="toctree-l2"><a class="reference internal" href="dbus-vmstate.html">D-Bus VMState</a></li>
<li class="toctree-l2"><a class="reference internal" href="live-block-operations.html">Live Block Device Operations</a></li>
<li class="toctree-l2"><a class="reference internal" href="pr-helper.html">Persistent reservation helper protocol</a></li>
<li class="toctree-l2"><a class="reference internal" href="qemu-ga.html">QEMU Guest Agent</a></li>
<li class="toctree-l2"><a class="reference internal" href="qemu-ga-ref.html">QEMU Guest Agent Protocol Reference</a></li>
<li class="toctree-l2"><a class="reference internal" href="qemu-qmp-ref.html">QEMU QMP Reference Manual</a></li>
<li class="toctree-l2"><a class="reference internal" href="qemu-storage-daemon-qmp-ref.html">QEMU Storage Daemon QMP Reference Manual</a></li>
<li class="toctree-l2"><a class="reference internal" href="vhost-user.html">Vhost-user Protocol</a></li>
<li class="toctree-l2"><a class="reference internal" href="vhost-user-gpu.html">Vhost-user-gpu Protocol</a></li>
<li class="toctree-l2"><a class="reference internal" href="vhost-vdpa.html">Vhost-vdpa Protocol</a></li>
</ul>
</li>
<li class="toctree-l1"><a class="reference internal" href="../specs/index.html">System Emulation Guest Hardware Specifications</a></li>
<li class="toctree-l1"><a class="reference internal" href="../devel/index.html">Developer Information</a></li>
</ul>

</div>
      </div>
    </nav>

<ul class="wy-breadcrumbs">
    
      <li><a href="../index.html">Docs</a> &raquo;</li>
        
          <li><a href="index.html">System Emulation Management and Interoperability</a> &raquo;</li>
        
      <li>D-Bus</li>
    
    
      <li class="wy-breadcrumbs-aside">
        
            
            
              <a href="https://gitlab.com/qemu-project/qemu/blob/master/docs/interop/dbus.rst" class="fa fa-gitlab"> Edit on GitLab</a>
            
          
        
      </li>
    
  </ul>

<hr/>
</div>
          <div role="main" class="document" itemscope="itemscope" itemtype="http://schema.org/Article">
           <div itemprop="articleBody">
            
  <div class="section" id="d-bus">
<h1>D-Bus<a class="headerlink" href="#d-bus" title="Permalink to this headline">¶</a></h1>
<div class="section" id="introduction">
<h2>Introduction<a class="headerlink" href="#introduction" title="Permalink to this headline">¶</a></h2>
<dl class="docutils">
<dt>QEMU may be running with various helper processes involved:</dt>
<dd><ul class="first last simple">
<li>vhost-user* processes (gpu, virtfs, input, etc…)</li>
<li>TPM emulation (or other devices)</li>
<li>user networking (slirp)</li>
<li>network services (DHCP/DNS, samba/ftp etc)</li>
<li>background tasks (compression, streaming etc)</li>
<li>client UI</li>
<li>admin &amp; cli</li>
</ul>
</dd>
</dl>
<p>Having several processes allows stricter security rules, as well as
greater modularity.</p>
<p>While QEMU itself uses QMP as primary IPC (and Spice/VNC for remote
display), D-Bus is the de facto IPC of choice on Unix systems. The
wire format is machine friendly, good bindings exist for various
languages, and there are various tools available.</p>
<p>Using a bus, helper processes can discover and communicate with each
other easily, without going through QEMU. The bus topology is also
easier to apprehend and debug than a mesh. However, it is wise to
consider the security aspects of it.</p>
</div>
<div class="section" id="security">
<h2>Security<a class="headerlink" href="#security" title="Permalink to this headline">¶</a></h2>
<p>A QEMU D-Bus bus should be private to a single VM. Thus, only
cooperative tasks are running on the same bus to serve the VM.</p>
<p>D-Bus, the protocol and standard, doesn’t have mechanisms to enforce
security between peers once the connection is established. Peers may
have additional mechanisms to enforce security rules, based for
example on UNIX credentials.</p>
<p>The daemon can control which peers can send/recv messages using
various metadata attributes, however, this is alone is not generally
sufficient to make the deployment secure.  The semantics of the actual
methods implemented using D-Bus are just as critical. Peers need to
carefully validate any information they received from a peer with a
different trust level.</p>
<div class="section" id="dbus-daemon-policy">
<h3>dbus-daemon policy<a class="headerlink" href="#dbus-daemon-policy" title="Permalink to this headline">¶</a></h3>
<p>dbus-daemon can enforce various policies based on the UID/GID of the
processes that are connected to it. It is thus a good idea to run
helpers as different UID from QEMU and set appropriate policies.</p>
<p>Depending on the use case, you may choose different scenarios:</p>
<blockquote>
<div><ul class="simple">
<li>Everything the same UID<ul>
<li>Convenient for developers</li>
<li>Improved reliability - crash of one part doesn’t take
out entire VM</li>
<li>No security benefit over traditional QEMU, unless additional
unless additional controls such as SELinux or AppArmor are
applied</li>
</ul>
</li>
<li>Two UIDs, one for QEMU, one for dbus &amp; helpers<ul>
<li>Moderately improved user based security isolation</li>
</ul>
</li>
<li>Many UIDs, one for QEMU one for dbus and one for each helpers<ul>
<li>Best user based security isolation</li>
<li>Complex to manager distinct UIDs needed for each VM</li>
</ul>
</li>
</ul>
</div></blockquote>
<p>For example, to allow only <code class="docutils literal notranslate"><span class="pre">qemu</span></code> user to talk to <code class="docutils literal notranslate"><span class="pre">qemu-helper</span></code>
<code class="docutils literal notranslate"><span class="pre">org.qemu.Helper1</span></code> service, a dbus-daemon policy may contain:</p>
<div class="code xml highlight-default notranslate"><div class="highlight"><pre><span></span><span class="o">&lt;</span><span class="n">policy</span> <span class="n">user</span><span class="o">=</span><span class="s2">&quot;qemu&quot;</span><span class="o">&gt;</span>
   <span class="o">&lt;</span><span class="n">allow</span> <span class="n">send_destination</span><span class="o">=</span><span class="s2">&quot;org.qemu.Helper1&quot;</span><span class="o">/&gt;</span>
   <span class="o">&lt;</span><span class="n">allow</span> <span class="n">receive_sender</span><span class="o">=</span><span class="s2">&quot;org.qemu.Helper1&quot;</span><span class="o">/&gt;</span>
<span class="o">&lt;/</span><span class="n">policy</span><span class="o">&gt;</span>

<span class="o">&lt;</span><span class="n">policy</span> <span class="n">user</span><span class="o">=</span><span class="s2">&quot;qemu-helper&quot;</span><span class="o">&gt;</span>
   <span class="o">&lt;</span><span class="n">allow</span> <span class="n">own</span><span class="o">=</span><span class="s2">&quot;org.qemu.Helper1&quot;</span><span class="o">/&gt;</span>
<span class="o">&lt;/</span><span class="n">policy</span><span class="o">&gt;</span>
</pre></div>
</div>
<p>dbus-daemon can also perform SELinux checks based on the security
context of the source and the target. For example, <code class="docutils literal notranslate"><span class="pre">virtiofs_t</span></code>
could be allowed to send a message to <code class="docutils literal notranslate"><span class="pre">svirt_t</span></code>, but <code class="docutils literal notranslate"><span class="pre">virtiofs_t</span></code>
wouldn’t be allowed to send a message to <code class="docutils literal notranslate"><span class="pre">virtiofs_t</span></code>.</p>
<p>See dbus-daemon man page for details.</p>
</div>
</div>
<div class="section" id="guidelines">
<h2>Guidelines<a class="headerlink" href="#guidelines" title="Permalink to this headline">¶</a></h2>
<p>When implementing new D-Bus interfaces, it is recommended to follow
the “D-Bus API Design Guidelines”:
<a class="reference external" href="https://dbus.freedesktop.org/doc/dbus-api-design.html">https://dbus.freedesktop.org/doc/dbus-api-design.html</a></p>
<p>The “org.qemu.*” prefix is reserved for services implemented &amp;
distributed by the QEMU project.</p>
</div>
<div class="section" id="qemu-interfaces">
<h2>QEMU Interfaces<a class="headerlink" href="#qemu-interfaces" title="Permalink to this headline">¶</a></h2>
<p><a class="reference internal" href="dbus-vmstate.html"><span class="doc">D-Bus VMState</span></a></p>
</div>
</div>

</div>
           
          </div>
          <footer>
  
    <div class="rst-footer-buttons" role="navigation" aria-label="footer navigation">
      
        <a href="dbus-vmstate.html" class="btn btn-neutral float-right" title="D-Bus VMState" accesskey="n" rel="next">Next <span class="fa fa-arrow-circle-right"></span></a>
      
      
        <a href="bitmaps.html" class="btn btn-neutral" title="Dirty Bitmaps and Incremental Backup" accesskey="p" rel="prev"><span class="fa fa-arrow-circle-left"></span> Previous</a>
      
    </div>

<hr/>

<div role="contentinfo">
    <p>
        &copy; Copyright 2021, The QEMU Project Developers.

</p>
  </div>
  Built with <a href="http://sphinx-doc.org/">Sphinx</a> using a <a href="https://github.com/rtfd/sphinx_rtd_theme">theme</a> provided by <a href="https://readthedocs.org">Read the Docs</a>.

<p></p>

<p>This documentation is for QEMU version 6.2.0.</p>

<p><a href="../about/license.html">QEMU and this manual are released under the
GNU General Public License, version 2.</a></p>

</footer>

</div>
      </div>

</section>

</div>

</body>
</html>