[Qemu-devel] PATCH-V7 0/10] virtio-9p:Introducing security model for VirtFS

[Venkateswararao Jujjuri (JV)]

This patch series introduces the security model for VirtFS.

Brief description of this patch series:

It introduces two type of security models for VirtFS.
They are: mapped and passthrough.

The following is common to both security models.

* Client's VFS determines/enforces the access control.
  Largely server should never return EACCESS.

* Client sends gid/mode-bit information as part of creation only.

Testing
-------
All the releavent tests of "Tuxera Posix test suite"
passed for both mapped and passthrough security models.

Changes from V6
---------------
o Introduced config check for attr/xattr (--enable-attr/--disable-attr)
o Defined a new config option CONFIG_VIRTFS, which will be set if 
  CONFIG_LINUX and CONFIG_ATTR are defined. VirtFS code is compiled
  only under CONFIG_VIRTFS.

Changes from V5
---------------
o After symlink creation used lchown to set the correct uid/gid
o local_chown uses lchown()

Changes from V4
---------------
o Most of the cosmetic changes proposed by Aneesh.
o Divided into more number of patches and added more explanation to each patch.

Changes from V3
---------------
o Return NULL instead of exit(1) on failure in virtio_9p_init()
o Capitalized sm_passthrough, sm_mappe
o Added handling for EINTR for read/write.
o Corrected default permissions for mkdir in mapped mode.
o Added additional error handling.

Changes from V2
---------------
o Removed warnings resulting from chmod/chown.
o Added code to fail normally if secuirty_model option is not specified.

Changes from V1
---------------
o Added support for chmod and chown.
o Used chmod/chown to set credentials instead of setuid/setgid.
o Fixed a bug where uid used instated of uid.


Security model: mapped
----------------------

VirtFS server(QEMU) intercepts and maps all the file object create requests.
Files on the fileserver will be created with QEMU's user credentials and the
client-user's credentials are stored in extended attributes.
During getattr() server extracts the client-user's credentials from extended
attributes and sends to the client.

Given that only the user space extended attributes are available to regular
files, special files are created as regular files on the fileserver and the
appropriate mode bits are stored in xattrs and will be extracted during
getattr.

If the extended attributes are missing, server sends back the filesystem
stat() unaltered. This provision will make the files created on the
fileserver usable to client.

Points to be considered

* Filesystem will be VirtFS'ized. Meaning, other filesystems may not
 understand the credentials of the files created under this model.

* Regular utilities like 'df' may not report required results in this model.
 Need for special reporting utilities which can understand this security model.


Security model : passthrough
----------------------------

In this security model, VirtFS server passes down all requests to the
underlying filesystem. File system objects on the fileserver will be created
with client-user's credentials. This is done by setting setuid()/setgid()
during creation or ch* after file creation. At the end of create protocol
request, files on the fileserver will be owned by cleint-user's uid/gid.

Points to be considered

  * Fileserver should always run as 'root'.
  * Root squashing may be needed. Will be for future work.
  * Potential for user credential clash between guest's user space IDs and
    host's user space IDs.

It also adds security model attribute to -fsdev device and to -virtfs shortcut.

Usage examples:
-fsdev local,id=jvrao,path=/tmp/,security_model=mapped
-virtfs local,path=/tmp/,security_model=passthrough,mnt_tag=v_tmp.

--
Signed-off-by: Venkateswararao Jujjuri <address@hidden>