From: Link Dupont <link@sub-pop.net>
To: Connor Kuehl <ckuehl@redhat.com>
Cc: virtio-fs-list <virtio-fs@redhat.com>, libvirt-users@redhat.com
Subject: Re: [Virtio-fs] virtiofs mounted filesystems & SELinux
Date: Thu, 03 Jun 2021 14:48:09 -0400 [thread overview]
Message-ID: <9W25UQ.OHKWX78P32DI3@sub-pop.net> (raw)
In-Reply-To: <ebd44751-333c-cb7a-5776-c63501558af6@redhat.com>
Adding the <binary xattr='on'> element to the <filesystem> device does
seem to spawn virtiofsd with the option string "source=/home,xattr". My
guest can no longer mount the device though.
It errors with:
[ 170.225553] 9pnet_virtio: no channels available
mount: mount(2) failed: No such file or directory
I think what this is doing is causing libvirt to create the device as a
virtiofs device instead of a 9p device. The EL7 kernel doesn't have a
virtiofs driver, so it can't mount virtiofs devices.
My knowledge is unfortunately limited about the nuances between 9p and
virtiofs. So I'm mostly experimenting by trial-and-error here.
On Wed, Jun 2 2021 at 03:55:40 PM -0500, Connor Kuehl
<ckuehl@redhat.com> wrote:
> On 5/21/21 11:59 AM, Link Dupont wrote:
>
> Adding the virtio-fs mailing list.
>
>> I am mounting a filesystem into a domain using the virtiofs driver.
>>
>> <filesystem accessmode="passthrough" type="mount">
>> <source dir="/home"/>
>> <target dir="/home"/>
>> <driver type="virtiofs"/>
>> </filesystem>
>>
>> Both my host (Fedora 34) and guest (CentOS 8.4) are running with
>> SELinux
>> enforcing. From my host, I can see that the SELinux context type is
>> set to
>> user_home_dir_t.
>>
>> $ ls -ldZ /home/link
>> drwxr-xr-x. 61 link link system_u:object_r:user_home_dir_t:s0 8192
>> May 21
>> 12:41 /home/link
>>
>>> From within the guest however, the volume is unlabeled_t
>>
>> $ ls -lZd /home/link
>> drwxr-xr-x. 61 link link system_u:object_r:unlabeled_t:s0 8192 May
>> 21 12:53 /
>> home/link
>>
>> Is there a way to pass the SELinux context through to the guest? Or
>> mount the
>> volume with the correct options to map SELinux contexts?
>>
>>
>
> Hi,
>
> I'm afraid I actually don't know that much about SELinux but I read
> that it relies on using extended attributes in the file system to
> accomplish its labeling.
>
> Do you still experience this issue when you enable extended attribute
> support[1] in virtiofsd? The example in the optional parameters
> snippet
> enables extended attributes with the xattr='on' element.
>
> Connor
>
> [1] https://libvirt.org/kbase/virtiofs.html#optional-parameters
>
next prev parent reply other threads:[~2021-06-03 18:48 UTC|newest]
Thread overview: 18+ messages / expand[flat|nested] mbox.gz Atom feed top
[not found] <2234280.ElGaqSPkdT@subpop>
2021-06-02 20:55 ` [Virtio-fs] virtiofs mounted filesystems & SELinux Connor Kuehl
2021-06-02 21:18 ` Harry G. Coin
2021-06-03 18:48 ` Link Dupont [this message]
2021-06-03 19:24 ` Dr. David Alan Gilbert
2021-06-04 0:56 ` Link Dupont
2021-06-04 2:14 ` Link Dupont
2021-06-04 13:30 ` Harry G. Coin
2021-06-04 14:11 ` Vivek Goyal
2021-06-04 14:50 ` Harry G. Coin
2021-06-04 13:44 ` Vivek Goyal
2021-06-04 13:59 ` Daniel P. Berrangé
2021-06-04 14:43 ` Vivek Goyal
2021-06-04 14:52 ` Daniel P. Berrangé
2021-06-07 13:01 ` Daniel Walsh
2021-06-07 14:05 ` Link Dupont
2021-06-07 14:15 ` Daniel P. Berrangé
2021-06-07 14:37 ` Harry G. Coin
2021-06-08 15:55 ` Dr. David Alan Gilbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9W25UQ.OHKWX78P32DI3@sub-pop.net \
--to=link@sub-pop.net \
--cc=ckuehl@redhat.com \
--cc=libvirt-users@redhat.com \
--cc=virtio-fs@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.