From nobody Sun Feb 8 23:05:10 2026 Delivered-To: importer@patchew.org Authentication-Results: mx.zohomail.com; dkim=fail; spf=pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) smtp.mailfrom=qemu-devel-bounces+importer=patchew.org@nongnu.org; dmarc=fail(p=none dis=none) header.from=redhat.com Return-Path: Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) by mx.zohomail.com with SMTPS id 1645111108048259.39588238853787; Thu, 17 Feb 2022 07:18:28 -0800 (PST) Received: from localhost ([::1]:39800 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1nKiY6-0002Sk-2L for importer@patchew.org; Thu, 17 Feb 2022 10:18:26 -0500 Received: from eggs.gnu.org ([209.51.188.92]:44894) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nKhnK-0001fA-L8 for qemu-devel@nongnu.org; Thu, 17 Feb 2022 09:30:06 -0500 Received: from us-smtp-delivery-124.mimecast.com ([170.10.133.124]:40080) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1nKhnI-0000jC-MN for qemu-devel@nongnu.org; Thu, 17 Feb 2022 09:30:06 -0500 Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) by relay.mimecast.com with ESMTP with STARTTLS (version=TLSv1.2, cipher=TLS_ECDHE_RSA_WITH_AES_256_GCM_SHA384) id us-mta-578-VSJMAdiTNvyZdB4z0e3Eaw-1; Thu, 17 Feb 2022 09:30:00 -0500 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id A758D1800D50; Thu, 17 Feb 2022 14:29:59 +0000 (UTC) Received: from dgilbert-t580.localhost (unknown [10.39.194.54]) by smtp.corp.redhat.com (Postfix) with ESMTP id 9FA9C6F948; Thu, 17 Feb 2022 14:29:40 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1645108204; h=from:from:reply-to:subject:subject:date:date:message-id:message-id: to:to:cc:cc:mime-version:mime-version:content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=hZFkhWKn51pkqx0EumhtyvE40npPVdZl7g0qnQFTgW8=; b=G5dL/rqqb09lXljSaAilvQiXXGzv+GEGeZ1BCUA++eUG0Zv40G+nOB5Zj8wmCVLqTIw8tx qOjYOYUGsKJvucIaJHZzFqciOZxu7DZ3oUKjKzPwNB8FhILVHc7ivxlbupF0CJ/Cx7xBVE h+dM712J67QjiesppW35r5bm9l2fpIc= X-MC-Unique: VSJMAdiTNvyZdB4z0e3Eaw-1 From: "Dr. David Alan Gilbert (git)" To: qemu-devel@nongnu.org, vgoyal@redhat.com, groug@kaod.org, sebastian.hasler@stuvus.uni-stuttgart.de Subject: [PULL 11/12] virtiofsd: Add an option to enable/disable security label Date: Thu, 17 Feb 2022 14:24:01 +0000 Message-Id: <20220217142402.52819-12-dgilbert@redhat.com> In-Reply-To: <20220217142402.52819-1-dgilbert@redhat.com> References: <20220217142402.52819-1-dgilbert@redhat.com> MIME-Version: 1.0 X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=dgilbert@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Transfer-Encoding: quoted-printable Received-SPF: pass (zohomail.com: domain of gnu.org designates 209.51.188.17 as permitted sender) client-ip=209.51.188.17; envelope-from=qemu-devel-bounces+importer=patchew.org@nongnu.org; helo=lists.gnu.org; Received-SPF: pass client-ip=170.10.133.124; envelope-from=dgilbert@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-Spam_score_int: -28 X-Spam_score: -2.9 X-Spam_bar: -- X-Spam_report: (-2.9 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.082, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_LOW=-0.7, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Cc: virtio-fs@redhat.com, stefanha@redhat.com, slp@redhat.com Errors-To: qemu-devel-bounces+importer=patchew.org@nongnu.org Sender: "Qemu-devel" X-ZohoMail-DKIM: fail (Header signature does not verify) X-ZM-MESSAGEID: 1645111111439100001 Content-Type: text/plain; charset="utf-8" From: Vivek Goyal Provide an option "-o security_label/no_security_label" to enable/disable security label functionality. By default these are turned off. If enabled, server will indicate to client that it is capable of handling one security label during file creation. Typically this is expected to be a SELinux label. File server will set this label on the file. It will try to set it atomically wherever possible. But its not possible in all the cases. Signed-off-by: Vivek Goyal Message-Id: <20220208204813.682906-11-vgoyal@redhat.com> Reviewed-by: Dr. David Alan Gilbert Signed-off-by: Dr. David Alan Gilbert --- docs/tools/virtiofsd.rst | 32 ++++++++++++++++++++++++++++++++ tools/virtiofsd/helper.c | 1 + tools/virtiofsd/passthrough_ll.c | 15 +++++++++++++++ 3 files changed, 48 insertions(+) diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst index 07ac0be551..0c0560203c 100644 --- a/docs/tools/virtiofsd.rst +++ b/docs/tools/virtiofsd.rst @@ -104,6 +104,13 @@ Options * posix_acl|no_posix_acl - Enable/disable posix acl support. Posix ACLs are disabled by default. =20 + * security_label|no_security_label - + Enable/disable security label support. Security labels are disabled by + default. This will allow client to send a MAC label of file during + file creation. Typically this is expected to be SELinux security + label. Server will try to set that label on newly created file + atomically wherever possible. + .. option:: --socket-path=3DPATH =20 Listen on vhost-user UNIX domain socket at PATH. @@ -348,6 +355,31 @@ client arguments or lists returned from the host. Thi= s stops the client seeing any 'security.' attributes on the server and stops it setting any. =20 +SELinux support +--------------- +One can enable support for SELinux by running virtiofsd with option +"-o security_label". But this will try to save guest's security context +in xattr security.selinux on host and it might fail if host's SELinux +policy does not permit virtiofsd to do this operation. + +Hence, it is preferred to remap guest's "security.selinux" xattr to say +"trusted.virtiofs.security.selinux" on host. + +"-o xattrmap=3D:map:security.selinux:trusted.virtiofs.:" + +This will make sure that guest and host's SELinux xattrs on same file +remain separate and not interfere with each other. And will allow both +host and guest to implement their own separate SELinux policies. + +Setting trusted xattr on host requires CAP_SYS_ADMIN. So one will need +add this capability to daemon. + +"-o modcaps=3D+sys_admin" + +Giving CAP_SYS_ADMIN increases the risk on system. Now virtiofsd is more +powerful and if gets compromised, it can do lot of damage to host system. +So keep this trade-off in my mind while making a decision. + Examples -------- =20 diff --git a/tools/virtiofsd/helper.c b/tools/virtiofsd/helper.c index a8295d975a..e226fc590f 100644 --- a/tools/virtiofsd/helper.c +++ b/tools/virtiofsd/helper.c @@ -187,6 +187,7 @@ void fuse_cmdline_help(void) " default: no_allow_direct_io\n" " -o announce_submounts Announce sub-mount points to th= e guest\n" " -o posix_acl/no_posix_acl Enable/Disable posix_acl. (defa= ult: disabled)\n" + " -o security_label/no_security_label Enable/Disable securi= ty label. (default: disabled)\n" ); } =20 diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough= _ll.c index 49f7caefbd..f586df955a 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -181,6 +181,7 @@ struct lo_data { int user_posix_acl, posix_acl; /* Keeps track if /proc//attr/fscreate should be used or not */ bool use_fscreate; + int user_security_label; }; =20 static const struct fuse_opt lo_opts[] =3D { @@ -215,6 +216,8 @@ static const struct fuse_opt lo_opts[] =3D { { "no_killpriv_v2", offsetof(struct lo_data, user_killpriv_v2), 0 }, { "posix_acl", offsetof(struct lo_data, user_posix_acl), 1 }, { "no_posix_acl", offsetof(struct lo_data, user_posix_acl), 0 }, + { "security_label", offsetof(struct lo_data, user_security_label), 1 }, + { "no_security_label", offsetof(struct lo_data, user_security_label), = 0 }, FUSE_OPT_END }; static bool use_syslog =3D false; @@ -808,6 +811,17 @@ static void lo_init(void *userdata, struct fuse_conn_i= nfo *conn) fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling posix_acl\n"); conn->want &=3D ~FUSE_CAP_POSIX_ACL; } + + if (lo->user_security_label =3D=3D 1) { + if (!(conn->capable & FUSE_CAP_SECURITY_CTX)) { + fuse_log(FUSE_LOG_ERR, "lo_init: Can not enable security label= ." + " kernel does not support FUSE_SECURITY_CTX capabilit= y.\n"); + } + conn->want |=3D FUSE_CAP_SECURITY_CTX; + } else { + fuse_log(FUSE_LOG_DEBUG, "lo_init: disabling security label\n"); + conn->want &=3D ~FUSE_CAP_SECURITY_CTX; + } } =20 static void lo_getattr(fuse_req_t req, fuse_ino_t ino, @@ -4288,6 +4302,7 @@ int main(int argc, char *argv[]) .proc_self_task =3D -1, .user_killpriv_v2 =3D -1, .user_posix_acl =3D -1, + .user_security_label =3D -1, }; struct lo_map_elem *root_elem; struct lo_map_elem *reserve_elem; --=20 2.35.1