From nobody Sat Nov 15 14:11:23 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1595422996; cv=none; d=zohomail.com; s=zohoarc; b=SRa630RmU8UVwCKH1dS6+n76R31/gExl1trGFVcmnyqW4DvUrzGmTo+2htAstTK5DKM3Y4iHHjbn7elmle3uZ4i9cfY3PRjhBk6uStcTihKE8CazMmVSvYjT5YIi5BtJPYcqFVwG80P92Kv8ub5TcuyFJ4TlbvrtlMTjvVJtDtw= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595422996; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=Yr1CGgd6WDzMgvUeb/6N1RZejGtuOVs/NxBt67a6fu8=; b=O7S7c51p7l6iKqS+DNSgvM2CWbNsTCyfrZhSGd4xzfr6HoXVQJVvRi2Fo8egpPbxJ+SiBzYtOMTnwiOTT0+oKz30h9GaTMm2Im4qbM3givRu4CCgztwMzmUE4ytku3PQGjErb3CV1IcieWp67zzBJ+WJXY6J52Y+4dO3743kFYE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 159542299608222.596185700313754; Wed, 22 Jul 2020 06:03:16 -0700 (PDT) Received: from localhost ([::1]:53954 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jyEOw-0008RS-TI for importer@patchew.org; Wed, 22 Jul 2020 09:03:14 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59698) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jyEOA-0007aR-Tl for qemu-devel@nongnu.org; Wed, 22 Jul 2020 09:02:26 -0400 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:36714 helo=us-smtp-delivery-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1jyEO9-0005z5-GG for qemu-devel@nongnu.org; Wed, 22 Jul 2020 09:02:26 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-267-q8e5NzvpOsuFUaUlqGZh-A-1; Wed, 22 Jul 2020 09:02:22 -0400 Received: from smtp.corp.redhat.com (int-mx08.intmail.prod.int.phx2.redhat.com [10.5.11.23]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id CDD9157 for ; Wed, 22 Jul 2020 13:02:21 +0000 (UTC) Received: from localhost (ovpn-114-42.ams2.redhat.com [10.36.114.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9A33E28559; Wed, 22 Jul 2020 13:02:15 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595422944; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=Yr1CGgd6WDzMgvUeb/6N1RZejGtuOVs/NxBt67a6fu8=; b=L61geNtNfXYJFolhsW89Q0mqjYm6Y3To6PMBU7HhiqBwDFOdJjwyVjOtB2i+qIxmtKh822 BPrh6KeponAo7b6hyIlZzcoNZgSDEz8PwVrskRqj5fUmcRAyc/BKWs41kAK03gOo+ElbBO /rhF8VzFgFAVSYO+EIETKrRUFymd4bA= X-MC-Unique: q8e5NzvpOsuFUaUlqGZh-A-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH for-5.1 1/3] virtiofsd: drop CAP_DAC_READ_SEARCH Date: Wed, 22 Jul 2020 14:02:04 +0100 Message-Id: <20200722130206.224898-2-stefanha@redhat.com> In-Reply-To: <20200722130206.224898-1-stefanha@redhat.com> References: <20200722130206.224898-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.23 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=207.211.31.81; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/21 23:34:34 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -13 X-Spam_score: -1.4 X-Spam_bar: - X-Spam_report: (-1.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: virtio-fs@redhat.com, rmohr@redhat.com, "Dr. David Alan Gilbert" , Stefan Hajnoczi , vromanso@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" virtiofsd does not need CAP_DAC_READ_SEARCH because it already has the more powerful CAP_DAC_OVERRIDE. Drop it from the list of capabilities. This is important because container runtimes may not include CAP_DAC_READ_SEARCH by default. This patch allows virtiofsd to reduce its capabilities when running inside a Docker container. Note that CAP_DAC_READ_SEARCH may be necessary again in the future if virtiofsd starts using open_by_handle_at(2). Signed-off-by: Stefan Hajnoczi Reviewed-by: Dr. David Alan Gilbert --- tools/virtiofsd/passthrough_ll.c | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough= _ll.c index 94e0de2d2b..50a164a599 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -2596,7 +2596,6 @@ static void setup_capabilities(char *modcaps_in) if (capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, CAP_CHOWN, CAP_DAC_OVERRIDE, - CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_SETGID, --=20 2.26.2 From nobody Sat Nov 15 14:11:23 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1595423057; cv=none; d=zohomail.com; s=zohoarc; b=lPRsrVaxFsuqPtSXhQpSgusNiE3UAKO3x5zGEj9SxsNOobR5Vy2zZ/FVadkZTSHCZUOmzgMymuoaK/oCZzuYATGvaPMezscbmSchONPuVnHkhO/tkwilrBcCJjCIHfZNhXHO4dvnW4GTZ3gDQQrfO5xaQjqoQi0Vr3IIoRlRdxk= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595423057; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=sAuM4mefPmI3Vs+rJUkeuqoZLzhq6DcjUvSlKGO0anc=; b=Q46K707khzP43FzAiF5lnUMeq+dhKNiVE+jfB+JHn9y7XEPszSo95+i8BAmbbhp9irE1SnJ5Xg2xQ8ZNuizk4Ei7zUd2Eastk3AdM2ea4veyR8ZldCtu6CjDM1D5/TF3z34wgrLUit6NWYavpt5n0kK6Bs0A+CIR590A6mXTFeE= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1595423057820271.82623492632456; Wed, 22 Jul 2020 06:04:17 -0700 (PDT) Received: from localhost ([::1]:58658 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jyEPw-0001vu-KY for importer@patchew.org; Wed, 22 Jul 2020 09:04:16 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59714) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jyEOI-0007nl-P5 for qemu-devel@nongnu.org; Wed, 22 Jul 2020 09:02:34 -0400 Received: from us-smtp-1.mimecast.com ([205.139.110.61]:44193 helo=us-smtp-delivery-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1jyEOH-00060r-20 for qemu-devel@nongnu.org; Wed, 22 Jul 2020 09:02:34 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-362-Hif9rI84OqupGnjWkK6AMQ-1; Wed, 22 Jul 2020 09:02:30 -0400 Received: from smtp.corp.redhat.com (int-mx07.intmail.prod.int.phx2.redhat.com [10.5.11.22]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 89F3A91271 for ; Wed, 22 Jul 2020 13:02:29 +0000 (UTC) Received: from localhost (ovpn-114-42.ams2.redhat.com [10.36.114.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id 05D2C1001B0B; Wed, 22 Jul 2020 13:02:22 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595422952; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=sAuM4mefPmI3Vs+rJUkeuqoZLzhq6DcjUvSlKGO0anc=; b=eG2qsuml4r61nuXUAVffPJ7jVVXoKK1Jz2aereaWpQj4RS6C16DZkkXB74bnkfnqgoRtKo WyyCc0IeoYeJjSRlG517pTMRI5a1d7bp3H6hvND6KGQeoMeSt79b+7EQjS1RM5H3UujNjy A7ulWsOFIvfc2dhFDskq1Z+DB+KYOLk= X-MC-Unique: Hif9rI84OqupGnjWkK6AMQ-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH for-5.1 2/3] virtiofsd: add container-friendly -o chroot sandboxing option Date: Wed, 22 Jul 2020 14:02:05 +0100 Message-Id: <20200722130206.224898-3-stefanha@redhat.com> In-Reply-To: <20200722130206.224898-1-stefanha@redhat.com> References: <20200722130206.224898-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.84 on 10.5.11.22 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=205.139.110.61; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/21 21:28:05 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: virtio-fs@redhat.com, rmohr@redhat.com, "Dr. David Alan Gilbert" , Stefan Hajnoczi , vromanso@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" virtiofsd cannot run in an unprivileged container because CAP_SYS_ADMIN is required to create namespaces. Introduce a weaker sandbox that is sufficient in container environments because the container runtime already sets up namespaces. Use chroot to restrict path traversal to the shared directory. virtiofsd loses the following: 1. Mount namespace. The process chroots to the shared directory but leaves the mounts in place. Seccomp rejects mount(2)/umount(2) syscalls. 2. Pid namespace. This should be fine because virtiofsd is the only process running in the container. 3. Network namespace. This should be fine because seccomp already rejects the connect(2) syscall, but an additional layer of security is lost. Container runtime-specific network security policies can be used drop network traffic (except for the vhost-user UNIX domain socket). Signed-off-by: Stefan Hajnoczi --- tools/virtiofsd/helper.c | 3 +++ tools/virtiofsd/passthrough_ll.c | 44 ++++++++++++++++++++++++++++++-- 2 files changed, 45 insertions(+), 2 deletions(-) diff --git a/tools/virtiofsd/helper.c b/tools/virtiofsd/helper.c index 3105b6c23a..7421c9ca1a 100644 --- a/tools/virtiofsd/helper.c +++ b/tools/virtiofsd/helper.c @@ -151,6 +151,9 @@ void fuse_cmdline_help(void) " -o cache=3D cache mode. could be one of \= "auto, " "always, none\"\n" " default: auto\n" + " -o chroot|no_chroot use container-friendly chroot i= nstead\n" + " of stronger mount namespace san= dbox\n" + " default: false\n" " -o flock|no_flock enable/disable flock\n" " default: no_flock\n" " -o log_level=3D log level, default to \"info\= "\n" diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough= _ll.c index 50a164a599..990c0a8a70 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -139,6 +139,7 @@ enum { =20 struct lo_data { pthread_mutex_t mutex; + int chroot; /* 1 - use chroot, 0 - use mount namespace */ int debug; int writeback; int flock; @@ -162,6 +163,8 @@ struct lo_data { }; =20 static const struct fuse_opt lo_opts[] =3D { + { "chroot", offsetof(struct lo_data, chroot), 1 }, + { "no_chroot", offsetof(struct lo_data, chroot), 0 }, { "writeback", offsetof(struct lo_data, writeback), 1 }, { "no_writeback", offsetof(struct lo_data, writeback), 0 }, { "source=3D%s", offsetof(struct lo_data, source), 0 }, @@ -2665,6 +2668,37 @@ static void setup_capabilities(char *modcaps_in) pthread_mutex_unlock(&cap.mutex); } =20 +/* + * Use chroot as a weaker sandbox for environment where the process is lau= nched + * without CAP_SYS_ADMIN. + */ +static void setup_chroot(struct lo_data *lo) +{ + lo->proc_self_fd =3D open("/proc/self/fd", O_PATH); + if (lo->proc_self_fd =3D=3D -1) { + fuse_log(FUSE_LOG_ERR, "open(\"/proc/self/fd\", O_PATH): %m\n"); + exit(1); + } + + /* + * Make the shared directory the file system root so that FUSE_OPEN + * (lo_open()) cannot escape the shared directory by opening a symlink. + * + * It's still possible to escape the chroot via lo->proc_self_fd but t= hat + * requires gaining control of the process first. + */ + if (chroot(lo->source) !=3D 0) { + fuse_log(FUSE_LOG_ERR, "chroot(\"%s\"): %m\n", lo->source); + exit(1); + } + + /* Move into the chroot */ + if (chdir("/") !=3D 0) { + fuse_log(FUSE_LOG_ERR, "chdir(\"/\"): %m\n"); + exit(1); + } +} + /* * Lock down this process to prevent access to other processes or files ou= tside * source directory. This reduces the impact of arbitrary code execution = bugs. @@ -2672,8 +2706,13 @@ static void setup_capabilities(char *modcaps_in) static void setup_sandbox(struct lo_data *lo, struct fuse_session *se, bool enable_syslog) { - setup_namespaces(lo, se); - setup_mounts(lo->source); + if (lo->chroot) { + setup_chroot(lo); + } else { + setup_namespaces(lo, se); + setup_mounts(lo->source); + } + setup_seccomp(enable_syslog); setup_capabilities(g_strdup(lo->modcaps)); } @@ -2820,6 +2859,7 @@ int main(int argc, char *argv[]) struct fuse_session *se; struct fuse_cmdline_opts opts; struct lo_data lo =3D { + .chroot =3D 0, .debug =3D 0, .writeback =3D 0, .posix_lock =3D 1, --=20 2.26.2 From nobody Sat Nov 15 14:11:23 2025 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1595423030; cv=none; d=zohomail.com; s=zohoarc; b=lzaJ+IwuCxuGGODeUmavffVdAtLVSyQB824/Z4Bj1T2S0+CyETcfbrjvk533RVeHOnHpRDNj0tziwo+SsjIcjSU97TtX3Pry1Shj9n86pSdrsSTTsilHj4uYFQgWyn+XgoAUJlrW3DxiI5eDnULvmZUqxRwLly0faQSnhTt0kSY= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595423030; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=JtaU6XyqFP8NrLJA88HkSXJMVAjAdcRT0OOcexGICOs=; b=SqKqAvPvm1ULpBsxqinxHx61k5zKKscDxP7NDeU04ZelXRRcfeZBW++Q9B+tRD9PO7F4Vd7MjRN5eHlrgVkkl+ymK9N2zO/b/G3fetNM3tPnf3k4C3i8534I/KLbdHYjRmBSEkySkBUNAa8mf1+aANAhrLsC2qWPbo1tXTDGtwo= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1595423030682107.35442253942006; Wed, 22 Jul 2020 06:03:50 -0700 (PDT) Received: from localhost ([::1]:56986 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1jyEPV-0001Gw-2B for importer@patchew.org; Wed, 22 Jul 2020 09:03:49 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:59904) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1jyEOi-0008SS-BP for qemu-devel@nongnu.org; Wed, 22 Jul 2020 09:03:00 -0400 Received: from us-smtp-2.mimecast.com ([207.211.31.81]:22794 helo=us-smtp-delivery-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1jyEOe-00063D-NF for qemu-devel@nongnu.org; Wed, 22 Jul 2020 09:03:00 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-123-G4rBlAc3O-CIqbpyd23T0g-1; Wed, 22 Jul 2020 09:02:39 -0400 Received: from smtp.corp.redhat.com (int-mx02.intmail.prod.int.phx2.redhat.com [10.5.11.12]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 480B559; Wed, 22 Jul 2020 13:02:38 +0000 (UTC) Received: from localhost (ovpn-114-42.ams2.redhat.com [10.36.114.42]) by smtp.corp.redhat.com (Postfix) with ESMTP id B29EC619B5; Wed, 22 Jul 2020 13:02:30 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595422975; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=JtaU6XyqFP8NrLJA88HkSXJMVAjAdcRT0OOcexGICOs=; b=ejaobmaAlIKEmzGAihgNplVWwZK2PX6s/rf7/rqevWlmNvpP5q+lx7V0zxoKM0/2Jv3tay 1FohM9EdPSm6FtXKWBvip8Ml9C5ZJ6Da6Hg2vgAXntuq6g97Nz0scwi7FJq58G5sAikBK3 5TBb+gX6PmUAwFE6sSVlPvzUhry+AoA= X-MC-Unique: G4rBlAc3O-CIqbpyd23T0g-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH for-5.1 3/3] virtiofsd: probe unshare(CLONE_FS) and print an error Date: Wed, 22 Jul 2020 14:02:06 +0100 Message-Id: <20200722130206.224898-4-stefanha@redhat.com> In-Reply-To: <20200722130206.224898-1-stefanha@redhat.com> References: <20200722130206.224898-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.12 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=stefanha@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=207.211.31.81; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/21 23:34:34 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -13 X-Spam_score: -1.4 X-Spam_bar: - X-Spam_report: (-1.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: vromanso@redhat.com, Misono Tomohiro , "Dr. David Alan Gilbert" , virtio-fs@redhat.com, Stefan Hajnoczi , rmohr@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" An assertion failure is raised during request processing if unshare(CLONE_FS) fails. Implement a probe at startup so the problem can be detected right away. Unfortunately Docker/Moby does not include unshare in the seccomp.json list unless CAP_SYS_ADMIN is given. Other seccomp.json lists always include unshare (e.g. podman is unaffected): https://raw.githubusercontent.com/seccomp/containers-golang/master/seccomp.= json Use "docker run --security-opt seccomp=3Dpath/to/seccomp.json ..." if the default seccomp.json is missing unshare. Cc: Misono Tomohiro Signed-off-by: Stefan Hajnoczi --- tools/virtiofsd/fuse_virtio.c | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c index 3b6d16a041..ebeb352514 100644 --- a/tools/virtiofsd/fuse_virtio.c +++ b/tools/virtiofsd/fuse_virtio.c @@ -949,6 +949,19 @@ int virtio_session_mount(struct fuse_session *se) { int ret; =20 + /* + * Test that unshare(CLONE_FS) works. fv_queue_worker() will need it. = It's + * an unprivileged system call but some Docker/Moby versions are known= to + * reject it via seccomp when CAP_SYS_ADMIN is not given. + */ + ret =3D unshare(CLONE_FS); + if (ret =3D=3D -1 && errno =3D=3D EPERM) { + fuse_log(FUSE_LOG_ERR, "unshare(CLONE_FS) failed with EPERM. If " + "running in a container please check that the container " + "runtime seccomp policy allows unshare.\n"); + return -1; + } + ret =3D fv_create_listen_socket(se); if (ret < 0) { return ret; --=20 2.26.2