From patchwork Mon Jul 27 19:02:20 2020 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Stefan Hajnoczi X-Patchwork-Id: 11687421 Return-Path: Received: from mail.kernel.org (pdx-korg-mail-1.web.codeaurora.org [172.30.200.123]) by pdx-korg-patchwork-2.web.codeaurora.org (Postfix) with ESMTP id ABD411392 for ; Mon, 27 Jul 2020 19:03:41 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 823892074F for ; Mon, 27 Jul 2020 19:03:41 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="e0C+0csl" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 823892074F Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Received: from localhost ([::1]:35480 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1k08PU-000427-NX for patchwork-qemu-devel@patchwork.kernel.org; Mon, 27 Jul 2020 15:03:40 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39792) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k08OU-0002y7-4Y for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:38 -0400 Received: from us-smtp-delivery-1.mimecast.com ([207.211.31.120]:53060 helo=us-smtp-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1k08OR-0007I3-Gq for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:37 -0400 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595876553; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding; bh=US8Pt7QJOnv4S7blifgxVX8+m8OxZb8Dr/ndHjUvHtk=; b=e0C+0cslthGr+QxnhqBA+8b7/qILY9mybYFuMC0AFe794/Q4yFPcXKGQi0at92tppeU7rS Pn4mH52VBLC+U1krbwyrNvKGU6hDidLpjz4DaWfZccYjjXcjYFisCDWeHSvCWiMXgfesEA 7cZ+uFsTFh3WNikWdr4g43g9DC6QpTQ= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-235-ly_nk1UsOyW_qHgdCO331A-1; Mon, 27 Jul 2020 15:02:32 -0400 X-MC-Unique: ly_nk1UsOyW_qHgdCO331A-1 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 02C861DE1 for ; Mon, 27 Jul 2020 19:02:31 +0000 (UTC) Received: from localhost (ovpn-114-74.ams2.redhat.com [10.36.114.74]) by smtp.corp.redhat.com (Postfix) with ESMTP id B47FF5D9F3; Mon, 27 Jul 2020 19:02:24 +0000 (UTC) From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH v2 0/3] virtiofsd: allow virtiofsd to run in a container Date: Mon, 27 Jul 2020 20:02:20 +0100 Message-Id: <20200727190223.422280-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Received-SPF: pass client-ip=207.211.31.120; envelope-from=stefanha@redhat.com; helo=us-smtp-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/27 15:02:33 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -30 X-Spam_score: -3.1 X-Spam_bar: --- X-Spam_report: (-3.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: vromanso@redhat.com, Daniel Walsh , "Dr. David Alan Gilbert" , rmohr@redhat.com, virtio-fs@redhat.com, Stefan Hajnoczi , mpatel@redhat.com, vgoyal@redhat.com Errors-To: qemu-devel-bounces+patchwork-qemu-devel=patchwork.kernel.org@nongnu.org Sender: "Qemu-devel" v2: * Update virtiofsd.rst documentation on sandboxing modes * Change syntax to -o sandbox=namespace|chroot * Add comment explaining that unshare(CLONE_FS) has no visible side-effect while single-threaded * xfstests and pjdfstest pass. Did not run tests on overlayfs because required xattrs do not work without CAP_SYS_ADMIN. Mrunal and Dan: This patch series adds a sandboxing mode where virtiofsd relies on the container runtime for isolation. It only does chroot("path/to/shared-dir"), seccomp, and drops Linux capabilities. Previously it created a new mount, pid, and net namespace but cannot do this without CAP_SYS_ADMIN when run inside a container. pivot_root("path/to/shared-dir") has been replaced with chroot("path/to/shared-dir"), again because CAP_SYS_ADMIN is unavailable. The point of the chroot() is to prevent escapes from the shared directory during path traversal. Does this ring any alarm bells or does it sound sane? Container runtimes handle namespace setup and remove privileges needed by virtiofsd to perform sandboxing. Luckily the container environment already provides most of the sandbox that virtiofsd needs for security. Introduce a new "virtiofsd -o sandbox=chroot" option that uses chroot(2) instead of namespaces. This option allows virtiofsd to work inside a container. Please see the individual patches for details on the changes and security implications. Given that people are starting to attempt running virtiofsd in containers I think this should go into QEMU 5.1. Stefan Hajnoczi (3): virtiofsd: drop CAP_DAC_READ_SEARCH virtiofsd: add container-friendly -o sandbox=chroot option virtiofsd: probe unshare(CLONE_FS) and print an error tools/virtiofsd/fuse_virtio.c | 16 +++++++++ tools/virtiofsd/helper.c | 8 +++++ tools/virtiofsd/passthrough_ll.c | 58 ++++++++++++++++++++++++++++++-- docs/tools/virtiofsd.rst | 32 ++++++++++++++---- 4 files changed, 104 insertions(+), 10 deletions(-)