From: Stefan Hajnoczi <stefanha@redhat.com>
To: qemu-devel@nongnu.org
Cc: vromanso@redhat.com, Daniel Walsh <dwalsh@redhat.com>,
"Dr. David Alan Gilbert" <dgilbert@redhat.com>,
rmohr@redhat.com, virtio-fs@redhat.com,
Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>,
Stefan Hajnoczi <stefanha@redhat.com>,
mpatel@redhat.com, vgoyal@redhat.com
Subject: [PATCH v2 3/3] virtiofsd: probe unshare(CLONE_FS) and print an error
Date: Mon, 27 Jul 2020 20:02:23 +0100 [thread overview]
Message-ID: <20200727190223.422280-4-stefanha@redhat.com> (raw)
In-Reply-To: <20200727190223.422280-1-stefanha@redhat.com>
An assertion failure is raised during request processing if
unshare(CLONE_FS) fails. Implement a probe at startup so the problem can
be detected right away.
Unfortunately Docker/Moby does not include unshare in the seccomp.json
list unless CAP_SYS_ADMIN is given. Other seccomp.json lists always
include unshare (e.g. podman is unaffected):
https://raw.githubusercontent.com/seccomp/containers-golang/master/seccomp.json
Use "docker run --security-opt seccomp=path/to/seccomp.json ..." if the
default seccomp.json is missing unshare.
Cc: Misono Tomohiro <misono.tomohiro@jp.fujitsu.com>
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
---
tools/virtiofsd/fuse_virtio.c | 16 ++++++++++++++++
1 file changed, 16 insertions(+)
diff --git a/tools/virtiofsd/fuse_virtio.c b/tools/virtiofsd/fuse_virtio.c
index 3b6d16a041..9e5537506c 100644
--- a/tools/virtiofsd/fuse_virtio.c
+++ b/tools/virtiofsd/fuse_virtio.c
@@ -949,6 +949,22 @@ int virtio_session_mount(struct fuse_session *se)
{
int ret;
+ /*
+ * Test that unshare(CLONE_FS) works. fv_queue_worker() will need it. It's
+ * an unprivileged system call but some Docker/Moby versions are known to
+ * reject it via seccomp when CAP_SYS_ADMIN is not given.
+ *
+ * Note that the program is single-threaded here so this syscall has no
+ * visible effect and is safe to make.
+ */
+ ret = unshare(CLONE_FS);
+ if (ret == -1 && errno == EPERM) {
+ fuse_log(FUSE_LOG_ERR, "unshare(CLONE_FS) failed with EPERM. If "
+ "running in a container please check that the container "
+ "runtime seccomp policy allows unshare.\n");
+ return -1;
+ }
+
ret = fv_create_listen_socket(se);
if (ret < 0) {
return ret;
--
2.26.2
next prev parent reply other threads:[~2020-07-27 19:05 UTC|newest]
Thread overview: 23+ messages / expand[flat|nested] mbox.gz Atom feed top
2020-07-27 19:02 [PATCH v2 0/3] virtiofsd: allow virtiofsd to run in a container Stefan Hajnoczi
2020-07-27 19:02 ` [PATCH v2 1/3] virtiofsd: drop CAP_DAC_READ_SEARCH Stefan Hajnoczi
2020-07-27 19:02 ` [PATCH v2 2/3] virtiofsd: add container-friendly -o sandbox=chroot option Stefan Hajnoczi
2020-08-07 15:36 ` Dr. David Alan Gilbert
2020-07-27 19:02 ` Stefan Hajnoczi [this message]
2020-07-28 1:05 ` [PATCH v2 3/3] virtiofsd: probe unshare(CLONE_FS) and print an error misono.tomohiro
2020-07-28 10:00 ` Roman Mohr
2020-07-28 13:12 ` Vivek Goyal
2020-07-28 15:52 ` Daniel P. Berrangé
2020-07-28 20:54 ` Vivek Goyal
2020-07-28 19:12 ` Daniel Walsh
2020-07-28 21:01 ` Vivek Goyal
2020-07-29 7:59 ` Roman Mohr
2020-07-29 14:40 ` Stefan Hajnoczi
2020-07-30 22:21 ` Daniel Walsh
2020-07-31 8:26 ` Stefan Hajnoczi
2020-07-31 8:39 ` Roman Mohr
2020-07-31 14:11 ` Stefan Hajnoczi
2020-07-28 15:32 ` Stefan Hajnoczi
2020-07-28 19:15 ` Daniel Walsh
2020-07-29 14:29 ` Stefan Hajnoczi
2020-08-07 15:29 ` Dr. David Alan Gilbert
2020-08-27 18:40 ` [PATCH v2 0/3] virtiofsd: allow virtiofsd to run in a container Dr. David Alan Gilbert
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=20200727190223.422280-4-stefanha@redhat.com \
--to=stefanha@redhat.com \
--cc=dgilbert@redhat.com \
--cc=dwalsh@redhat.com \
--cc=misono.tomohiro@jp.fujitsu.com \
--cc=mpatel@redhat.com \
--cc=qemu-devel@nongnu.org \
--cc=rmohr@redhat.com \
--cc=vgoyal@redhat.com \
--cc=virtio-fs@redhat.com \
--cc=vromanso@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).