From nobody Sun Feb 8 18:44:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1595876654; cv=none; d=zohomail.com; s=zohoarc; b=JdGWo4zFK8KoRnHG1DoLCyw+Nj9++iLhBC799Qsu4sK0NO+k8VomXDj0YZgGF+RHkNm/Bhz8WsDpOtQ8NhsT8poFNhMBn+n8AyJV5Ftccz8oXAU7Arp55fLpCdpiKC3flMFsRJKQGCN44z+dHmCasK1GBfeqlrzvyUQ+7h0oIPI= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595876654; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=CEigPhAsJlaMyex/Vvtyzdslzb9kdarksDey735m440=; b=Z7NIyabqMJQEk2fHJWKTtvN+G9XghEt3zSowIvUrnCuVzU1Ob0JnmDOcqGOL8/HCRAbiU/CmKIVCtUf2CepQYy1TbF9G0PEx3OZ1zcSwls5FEb7TBexRs8UwJSDqw8b4tSDZONsBhSTfGO0Fel9d4qeNbO+GsXXzWX6q4Y8T+uk= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 159587665466313.055698289777183; Mon, 27 Jul 2020 12:04:14 -0700 (PDT) Received: from localhost ([::1]:36042 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1k08Q1-0004GX-Bh for importer@patchew.org; Mon, 27 Jul 2020 15:04:13 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39836) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k08Oa-00032l-5L for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:44 -0400 Received: from us-smtp-delivery-1.mimecast.com ([205.139.110.120]:32025 helo=us-smtp-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1k08OY-0007Iu-Nc for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:43 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-326-E7xks-oBNfugWaQyRCfJPg-1; Mon, 27 Jul 2020 15:02:39 -0400 Received: from smtp.corp.redhat.com (int-mx01.intmail.prod.int.phx2.redhat.com [10.5.11.11]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9123059 for ; Mon, 27 Jul 2020 19:02:38 +0000 (UTC) Received: from localhost (ovpn-114-74.ams2.redhat.com [10.36.114.74]) by smtp.corp.redhat.com (Postfix) with ESMTP id 7F831712D7; Mon, 27 Jul 2020 19:02:32 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595876561; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=CEigPhAsJlaMyex/Vvtyzdslzb9kdarksDey735m440=; b=OnGOghG+ZPyH+hnnKa8rH8J9drfCf6THWX8Ib/DNJZZVWx/OJ7ywhICGOYIHBAkEnK/mkC CggsYadXKDrWcTvn/3KaEggp0LmahmMtFBkrFPWnHs8hxKYpkcAEOQYjNjs6iSCHaqjiwG IcWvxnuMaw/i/5v49nGtRkv2TF5IJL4= X-MC-Unique: E7xks-oBNfugWaQyRCfJPg-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH v2 1/3] virtiofsd: drop CAP_DAC_READ_SEARCH Date: Mon, 27 Jul 2020 20:02:21 +0100 Message-Id: <20200727190223.422280-2-stefanha@redhat.com> In-Reply-To: <20200727190223.422280-1-stefanha@redhat.com> References: <20200727190223.422280-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.11 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=205.139.110.120; envelope-from=stefanha@redhat.com; helo=us-smtp-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/27 01:44:14 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: vromanso@redhat.com, Daniel Walsh , "Dr. David Alan Gilbert" , rmohr@redhat.com, virtio-fs@redhat.com, Stefan Hajnoczi , mpatel@redhat.com, vgoyal@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" virtiofsd does not need CAP_DAC_READ_SEARCH because it already has the more powerful CAP_DAC_OVERRIDE. Drop it from the list of capabilities. This is important because container runtimes may not include CAP_DAC_READ_SEARCH by default. This patch allows virtiofsd to reduce its capabilities when running inside a Docker container. Note that CAP_DAC_READ_SEARCH may be necessary again in the future if virtiofsd starts using open_by_handle_at(2). Signed-off-by: Stefan Hajnoczi Reviewed-by: Dr. David Alan Gilbert --- tools/virtiofsd/passthrough_ll.c | 1 - 1 file changed, 1 deletion(-) diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough= _ll.c index 94e0de2d2b..50a164a599 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -2596,7 +2596,6 @@ static void setup_capabilities(char *modcaps_in) if (capng_updatev(CAPNG_ADD, CAPNG_PERMITTED | CAPNG_EFFECTIVE, CAP_CHOWN, CAP_DAC_OVERRIDE, - CAP_DAC_READ_SEARCH, CAP_FOWNER, CAP_FSETID, CAP_SETGID, --=20 2.26.2 From nobody Sun Feb 8 18:44:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1595876665; cv=none; d=zohomail.com; s=zohoarc; b=XEjnrzXsN//pZBy3XtxIMs4d2E5vTjy3gW7qAU2RP4Wm2Qd5SW2WU+ngyL6qnK9E4wFHueJLh4NikJxsFwcgqqOCov4GTpU6ppdGo4OkeiLesYMuxi8npZIOwSjHm/cEKNU61mER9dlpfXtjTaUe8A4CkoO6nK5j0z3lisQ0O+w= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595876665; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=BJm5Iqwq6aS7x0W/9rNPFJT6OynMd7LGup3XRro6eWY=; b=av45ltPXeHVwDp61Si1LxC0f3MO2+wakqnBldSa9A5DFj6NJJwgFtCeqnK6RQG6ZMq/OrH5zi733J+q/D6pc8HLolSGkhWMXdapVhYYm1di1rUoAp7lnN1ZT9dR19wgg+Zyl7lEP8Q9OwzbfjyjM+yvG0HWLLqmeu1ratStasDY= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1595876665702267.2405719612449; Mon, 27 Jul 2020 12:04:25 -0700 (PDT) Received: from localhost ([::1]:36586 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1k08QC-0004UB-Co for importer@patchew.org; Mon, 27 Jul 2020 15:04:24 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39848) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k08Oe-00038k-Ej for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:48 -0400 Received: from us-smtp-delivery-1.mimecast.com ([205.139.110.120]:39906 helo=us-smtp-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1k08Oc-0007Iy-F8 for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:48 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-492-yamhOouBPPmg6okX-PpKEw-1; Mon, 27 Jul 2020 15:02:41 -0400 Received: from smtp.corp.redhat.com (int-mx04.intmail.prod.int.phx2.redhat.com [10.5.11.14]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 9D905186A835 for ; Mon, 27 Jul 2020 19:02:40 +0000 (UTC) Received: from localhost (ovpn-114-74.ams2.redhat.com [10.36.114.74]) by smtp.corp.redhat.com (Postfix) with ESMTP id 30CFD5D9DD; Mon, 27 Jul 2020 19:02:39 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595876563; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=BJm5Iqwq6aS7x0W/9rNPFJT6OynMd7LGup3XRro6eWY=; b=C7XBrrGikGhVprL6AJIwKNsE4EwSxbr0kcSxAXyeY9FCKUsbvvdsSYnAH739UVd5QQ3eML XX+Q9BfAKVXdGG2lD8wXgHCXkTdpM1Rh5BSPNkFu2czkgwcHnyicS+qZeI+Gp787BbJWG9 20lr0qMzsRWfE7dTigKMbgyl6mS4ej8= X-MC-Unique: yamhOouBPPmg6okX-PpKEw-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH v2 2/3] virtiofsd: add container-friendly -o sandbox=chroot option Date: Mon, 27 Jul 2020 20:02:22 +0100 Message-Id: <20200727190223.422280-3-stefanha@redhat.com> In-Reply-To: <20200727190223.422280-1-stefanha@redhat.com> References: <20200727190223.422280-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.14 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=205.139.110.120; envelope-from=stefanha@redhat.com; helo=us-smtp-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/27 01:44:14 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: vromanso@redhat.com, Daniel Walsh , "Dr. David Alan Gilbert" , rmohr@redhat.com, virtio-fs@redhat.com, Stefan Hajnoczi , mpatel@redhat.com, vgoyal@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" virtiofsd cannot run in a container because CAP_SYS_ADMIN is required to create namespaces. Introduce a weaker sandbox mode that is sufficient in container environments because the container runtime already sets up namespaces. Use chroot to restrict path traversal to the shared directory. virtiofsd loses the following: 1. Mount namespace. The process chroots to the shared directory but leaves the mounts in place. Seccomp rejects mount(2)/umount(2) syscalls. 2. Pid namespace. This should be fine because virtiofsd is the only process running in the container. 3. Network namespace. This should be fine because seccomp already rejects the connect(2) syscall, but an additional layer of security is lost. Container runtime-specific network security policies can be used drop network traffic (except for the vhost-user UNIX domain socket). Signed-off-by: Stefan Hajnoczi --- tools/virtiofsd/helper.c | 8 +++++ tools/virtiofsd/passthrough_ll.c | 57 ++++++++++++++++++++++++++++++-- docs/tools/virtiofsd.rst | 32 ++++++++++++++---- 3 files changed, 88 insertions(+), 9 deletions(-) diff --git a/tools/virtiofsd/helper.c b/tools/virtiofsd/helper.c index 3105b6c23a..91dcb23664 100644 --- a/tools/virtiofsd/helper.c +++ b/tools/virtiofsd/helper.c @@ -168,6 +168,14 @@ void fuse_cmdline_help(void) " enable/disable readirplus\n" " default: readdirplus except wit= h " "cache=3Dnone\n" + " -o sandbox=3Dnamespace|chroot\n" + " sandboxing mode:\n" + " - namespace: mount, pid, and ne= t\n" + " namespaces with pivot_root(2)= \n" + " into shared directory\n" + " - chroot: chroot(2) into shared= \n" + " directory (use in containers)= \n" + " default: namespace\n" " -o timeout=3D I/O timeout (seconds)\n" " default: depends on cache=3D op= tion.\n" " -o writeback|no_writeback enable/disable writeback cache\= n" diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough= _ll.c index 50a164a599..a7894c3e7c 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -137,8 +137,14 @@ enum { CACHE_ALWAYS, }; =20 +enum { + SANDBOX_NAMESPACE, + SANDBOX_CHROOT, +}; + struct lo_data { pthread_mutex_t mutex; + int sandbox; int debug; int writeback; int flock; @@ -162,6 +168,12 @@ struct lo_data { }; =20 static const struct fuse_opt lo_opts[] =3D { + { "sandbox=3Dnamespace", + offsetof(struct lo_data, sandbox), + SANDBOX_NAMESPACE }, + { "sandbox=3Dchroot", + offsetof(struct lo_data, sandbox), + SANDBOX_CHROOT }, { "writeback", offsetof(struct lo_data, writeback), 1 }, { "no_writeback", offsetof(struct lo_data, writeback), 0 }, { "source=3D%s", offsetof(struct lo_data, source), 0 }, @@ -2665,6 +2677,41 @@ static void setup_capabilities(char *modcaps_in) pthread_mutex_unlock(&cap.mutex); } =20 +/* + * Use chroot as a weaker sandbox for environments where the process is + * launched without CAP_SYS_ADMIN. + */ +static void setup_chroot(struct lo_data *lo) +{ + lo->proc_self_fd =3D open("/proc/self/fd", O_PATH); + if (lo->proc_self_fd =3D=3D -1) { + fuse_log(FUSE_LOG_ERR, "open(\"/proc/self/fd\", O_PATH): %m\n"); + exit(1); + } + + /* + * Make the shared directory the file system root so that FUSE_OPEN + * (lo_open()) cannot escape the shared directory by opening a symlink. + * + * The chroot(2) syscall is later disabled by seccomp and the + * CAP_SYS_CHROOT capability is dropped so that tampering with the chr= oot + * is not possible. + * + * However, it's still possible to escape the chroot via lo->proc_self= _fd + * but that requires first gaining control of the process. + */ + if (chroot(lo->source) !=3D 0) { + fuse_log(FUSE_LOG_ERR, "chroot(\"%s\"): %m\n", lo->source); + exit(1); + } + + /* Move into the chroot */ + if (chdir("/") !=3D 0) { + fuse_log(FUSE_LOG_ERR, "chdir(\"/\"): %m\n"); + exit(1); + } +} + /* * Lock down this process to prevent access to other processes or files ou= tside * source directory. This reduces the impact of arbitrary code execution = bugs. @@ -2672,8 +2719,13 @@ static void setup_capabilities(char *modcaps_in) static void setup_sandbox(struct lo_data *lo, struct fuse_session *se, bool enable_syslog) { - setup_namespaces(lo, se); - setup_mounts(lo->source); + if (lo->sandbox =3D=3D SANDBOX_NAMESPACE) { + setup_namespaces(lo, se); + setup_mounts(lo->source); + } else { + setup_chroot(lo); + } + setup_seccomp(enable_syslog); setup_capabilities(g_strdup(lo->modcaps)); } @@ -2820,6 +2872,7 @@ int main(int argc, char *argv[]) struct fuse_session *se; struct fuse_cmdline_opts opts; struct lo_data lo =3D { + .sandbox =3D SANDBOX_NAMESPACE, .debug =3D 0, .writeback =3D 0, .posix_lock =3D 1, diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst index 824e713491..40629f95ae 100644 --- a/docs/tools/virtiofsd.rst +++ b/docs/tools/virtiofsd.rst @@ -17,13 +17,24 @@ This program is designed to work with QEMU's ``--device= vhost-user-fs-pci`` but should work with any virtual machine monitor (VMM) that supports vhost-user. See the Examples section below. =20 -This program must be run as the root user. Upon startup the program will -switch into a new file system namespace with the shared directory tree as = its -root. This prevents "file system escapes" due to symlinks and other file -system objects that might lead to files outside the shared directory. The -program also sandboxes itself using seccomp(2) to prevent ptrace(2) and ot= her -vectors that could allow an attacker to compromise the system after gaining -control of the virtiofsd process. +This program must be run as the root user. The program drops privileges w= here +possible during startup although it must be able to create and access files +with any uid/gid: + +* The ability to invoke syscalls is limited using seccomp(2). +* Linux capabilities(7) are dropped. + +In "namespace" sandbox mode the program switches into a new file system +namespace and invokes pivot_root(2) to make the shared directory tree its = root. +A new pid and net namespace is also created to isolate the process. + +In "chroot" sandbox mode the program invokes chroot(2) to make the shared +directory tree its root. This mode is intended for container environments = where +the container runtime has already set up the namespaces and the program do= es +not have permission to create namespaces itself. + +Both sandbox modes prevent "file system escapes" due to symlinks and other= file +system objects that might lead to files outside the shared directory. =20 Options ------- @@ -72,6 +83,13 @@ Options * readdirplus|no_readdirplus - Enable/disable readdirplus. The default is ``readdirplus``. =20 + * sandbox=3Dnamespace|chroot - + Sandbox mode: + - namespace: Create mount, pid, and net namespaces and pivot_root(2) i= nto + the shared directory. + - chroot: chroot(2) into shared directory (use in containers). + The default is "namespace". + * source=3DPATH - Share host directory tree located at PATH. This option is required. =20 --=20 2.26.2 From nobody Sun Feb 8 18:44:05 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com ARC-Seal: i=1; a=rsa-sha256; t=1595876723; cv=none; d=zohomail.com; s=zohoarc; b=XRrdjhd/8wwkXyYJrcbNSskUDAnmHCzp1SD+Qekt1kOxeSMVymL7m+U8Zz/Bjv4vJCnPFDu1OothAlaaxD5gf4/isG0fPjYNPO6glk85tFzcTAzyYEPVf+kFU4I/SCFDs/k6oymGC2z5PL9ttxp0TTn8BYTqEECoHi6O3kCvEsc= ARC-Message-Signature: i=1; a=rsa-sha256; c=relaxed/relaxed; d=zohomail.com; s=zohoarc; t=1595876723; h=Content-Type:Content-Transfer-Encoding:Cc:Date:From:In-Reply-To:List-Subscribe:List-Post:List-Id:List-Archive:List-Help:List-Unsubscribe:MIME-Version:Message-ID:References:Sender:Subject:To; bh=+DTzCWtkAYWXXwDS71eiC1B/ZYAtPEUDUkQAuCNxmV0=; b=If7iLIRZ43lSKfIvOSrBDweDDAnBAt6MP50Bx9b2pFhiOFeW3GvMRk2ZeAqe+0w57nSZpN9dDyql+ZO9HFNhG70h5CaWJy3YIYS+mfY5aehM5UiqnfE6ZzfXL7nrEVK8A0mLA7eAHAo8pRjpdcfkaFAPxGfI5YHhwEOebDoITKM= ARC-Authentication-Results: i=1; mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail header.from= (p=none dis=none) header.from= Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1595876723056249.8570707792402; Mon, 27 Jul 2020 12:05:23 -0700 (PDT) Received: from localhost ([::1]:40358 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1k08R7-00065w-Oi for importer@patchew.org; Mon, 27 Jul 2020 15:05:21 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]:39884) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1k08Op-0003N3-20 for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:59 -0400 Received: from us-smtp-2.mimecast.com ([205.139.110.61]:53638 helo=us-smtp-delivery-1.mimecast.com) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1k08On-0007JG-5G for qemu-devel@nongnu.org; Mon, 27 Jul 2020 15:02:58 -0400 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-336-5SAXAgUaPwKyb32WpT4kTw-1; Mon, 27 Jul 2020 15:02:50 -0400 Received: from smtp.corp.redhat.com (int-mx03.intmail.prod.int.phx2.redhat.com [10.5.11.13]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id 34F2E106B243; Mon, 27 Jul 2020 19:02:48 +0000 (UTC) Received: from localhost (ovpn-114-74.ams2.redhat.com [10.36.114.74]) by smtp.corp.redhat.com (Postfix) with ESMTP id 0A84890E63; Mon, 27 Jul 2020 19:02:41 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1595876575; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=+DTzCWtkAYWXXwDS71eiC1B/ZYAtPEUDUkQAuCNxmV0=; b=FO+0w1AQKuhLRS/B0XsKaxVIJ4TMt6Vb1mgLYT+zNPAEPMRsQt2S9BkCcjqkaGLVlHNehH JPjyMMjjWE+qDtjPqC3rSlspO/EipRkXP7r2y6dVT16agPgHdzq+FXZslqNjIm3iUVlVNy qpga4EJjZK3iDUd1FZ7m2w5MBkNjG40= X-MC-Unique: 5SAXAgUaPwKyb32WpT4kTw-1 From: Stefan Hajnoczi To: qemu-devel@nongnu.org Subject: [PATCH v2 3/3] virtiofsd: probe unshare(CLONE_FS) and print an error Date: Mon, 27 Jul 2020 20:02:23 +0100 Message-Id: <20200727190223.422280-4-stefanha@redhat.com> In-Reply-To: <20200727190223.422280-1-stefanha@redhat.com> References: <20200727190223.422280-1-stefanha@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.13 X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=205.139.110.61; envelope-from=stefanha@redhat.com; helo=us-smtp-delivery-1.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/07/27 01:46:13 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -23 X-Spam_score: -2.4 X-Spam_bar: -- X-Spam_report: (-2.4 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-1, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, MIME_BASE64_TEXT=1.741, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H2=-1, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: vromanso@redhat.com, Daniel Walsh , "Dr. David Alan Gilbert" , rmohr@redhat.com, virtio-fs@redhat.com, Misono Tomohiro , Stefan Hajnoczi , mpatel@redhat.com, vgoyal@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) Content-Type: text/plain; charset="utf-8" An assertion failure is raised during request processing if unshare(CLONE_FS) fails. Implement a probe at startup so the problem can be detected right away. Unfortunately Docker/Moby does not include unshare in the seccomp.json list unless CAP_SYS_ADMIN is given. Other seccomp.json lists always include unshare (e.g. podman is unaffected): https://raw.githubusercontent.com/seccomp/containers-golang/master/seccomp.= json Use "docker run --security-opt seccomp=3Dpath/to/seccomp.json ..." if the default seccomp.json is missing unshare. Cc: Misono Tomohiro Signed-off-by: Stefan Hajnoczi Reviewed-by: Misono Tomohiro --- tools/virtiofsd/fuse_virtio.c | 16 ++++++++++++++++ 1 file changed, 16 insertions(+) diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c index 3b6d16a041..9e5537506c 100644 --- a/tools/virtiofsd/fuse_virtio.c +++ b/tools/virtiofsd/fuse_virtio.c @@ -949,6 +949,22 @@ int virtio_session_mount(struct fuse_session *se) { int ret; =20 + /* + * Test that unshare(CLONE_FS) works. fv_queue_worker() will need it. = It's + * an unprivileged system call but some Docker/Moby versions are known= to + * reject it via seccomp when CAP_SYS_ADMIN is not given. + * + * Note that the program is single-threaded here so this syscall has no + * visible effect and is safe to make. + */ + ret =3D unshare(CLONE_FS); + if (ret =3D=3D -1 && errno =3D=3D EPERM) { + fuse_log(FUSE_LOG_ERR, "unshare(CLONE_FS) failed with EPERM. If " + "running in a container please check that the container " + "runtime seccomp policy allows unshare.\n"); + return -1; + } + ret =3D fv_create_listen_socket(se); if (ret < 0) { return ret; --=20 2.26.2