From mboxrd@z Thu Jan 1 00:00:00 1970 Date: Wed, 22 Jul 2020 14:19:14 -0400 From: Vivek Goyal Message-ID: <20200722181914.GB598987@redhat.com> References: <20200722130206.224898-1-stefanha@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <20200722130206.224898-1-stefanha@redhat.com> Subject: Re: [Virtio-fs] [PATCH for-5.1 0/3] virtiofsd: allow virtiofsd to run in a container List-Id: Development discussions about virtio-fs List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Stefan Hajnoczi Cc: virtio-fs@redhat.com, vromanso@redhat.com, qemu-devel@nongnu.org, rmohr@redhat.com On Wed, Jul 22, 2020 at 02:02:03PM +0100, Stefan Hajnoczi wrote: > Container runtimes handle namespace setup and remove privileges needed by > virtiofsd to perform sandboxing. Luckily the container environment already > provides most of the sandbox that virtiofsd needs for security. > > Introduce a new "virtiofsd -o chroot" option that uses chroot(2) instead of > namespaces. This option allows virtiofsd to work inside a container. > > Please see the individual patches for details on the changes and security > implications. > > Given that people are starting to attempt running virtiofsd in containers I > think this should go into QEMU 5.1. Hi Stefan, I have written a document to help with testing virtiofs with any changes. https://github.com/rhvgoyal/misc/blob/master/virtiofs-tests/virtio-fs-testing-requirement.txt Will be good to run some of these tests to make sure there are no regressions due to these changes. Thanks Vivek > > Stefan Hajnoczi (3): > virtiofsd: drop CAP_DAC_READ_SEARCH > virtiofsd: add container-friendly -o chroot sandboxing option > virtiofsd: probe unshare(CLONE_FS) and print an error > > tools/virtiofsd/fuse_virtio.c | 13 +++++++++ > tools/virtiofsd/helper.c | 3 +++ > tools/virtiofsd/passthrough_ll.c | 45 +++++++++++++++++++++++++++++--- > 3 files changed, 58 insertions(+), 3 deletions(-) > > -- > 2.26.2 > > > _______________________________________________ > Virtio-fs mailing list > Virtio-fs@redhat.com > https://www.redhat.com/mailman/listinfo/virtio-fs