| Message ID | 20201014180209.49299-2-dgilbert@redhat.com |
|---|---|
| State | New |
| Headers | show |
| Series | virtiofsd xattr name mappings | expand |
On Wed, Oct 14, 2020 at 07:02:05PM +0100, Dr. David Alan Gilbert (git) wrote: > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > Add an option to define mappings of xattr names so that > the client and server filesystems see different views. > This can be used to have different SELinux mappings as > seen by the guest, to run the virtiofsd with less privileges > (e.g. in a case where it can't set trusted/system/security > xattrs but you want the guest to be able to), or to isolate > multiple users of the same name; e.g. trusted attributes > used by stacking overlayfs. > > A mapping engine is used wit 3 simple rules; the rules can s/wit/with/ > +``:type:scope:key:prepend:`` > + > +**type** is one of: > + > +- 'prefix' - If 'key' matches the client then the 'prepend' > + is added before the name is passed to the server. > + For a server case, the prepend is tested and stripped > + if matching. It may be clearer to document rule types like this: - :prefix:client:key:prepend: - Add 'prepend' before the name if it starts with 'key'. - :prefix:server::prepend: - Strip 'prepend' if the name starts with it. The client vs server behavior is independent so it's clearer to list them as separate cases. In addition, using the full rule syntax shows which fields are valid arguments and which ones are ignored. The 'all' scope can be documented later as "Combines both the 'client' and 'server' scope behavior". > + > +- 'ok' - The attribute name is OK and passed through to > + the server unchanged. The documentation isn't explicit but I think the default behavior is to allow all xattr names? What is the purpose of the 'ok' rule? I guess it's to define an exception to a later 'prefix' or 'bad' rule. It would be nice to make this clear. The documentation only mentions :client: behavior, leaving :server: undefined. Please indicate whether this rule has an effect in server scope. > + > +- 'bad' - If a client tries to use this name it's > + denied using EPERM; when the server passes an attribute > + name matching it's hidden. > + > +**scope** is: > + > +- 'client' - match 'key' against a xattr name from the client for > + setxattr/getxattr/removexattr > +- 'server' - match 'prepend' against a xattr name from the server > + for listxattr > +- 'all' - can be used to match both cases. > + > +**key** is a string tested as a prefix on an attribute name originating > +on the client. It maybe empty in which case a 'client' rule > +will always match on client names. Is there a way to match a full string instead of a prefix (regexp ^<pattern>$ instead of ^<pattern>)? > @@ -2010,6 +2020,169 @@ static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi, > fuse_reply_err(req, res == -1 ? errno : 0); > } > > +/* > + * Exit; process attribute unmodified if matched. > + * An empty key applies to all. > + */ > +#define XATTR_MAP_FLAG_END_OK (1 << 0) > +/* > + * The attribute is unwanted; > + * EPERM on write hidden on read. Making this sentence easier to parse: s/write hidden/write, hidden/ > + */ > +#define XATTR_MAP_FLAG_END_BAD (1 << 1) > +/* > + * For attr that start with 'key' prepend 'prepend' > + * 'key' maybe empty to prepend for all attrs s/maybe/may be/ > + /* Add a terminator to error in cases the user hasn't specified */ > + tmp_entry.flags = XATTR_MAP_FLAG_ALL | XATTR_MAP_FLAG_END_BAD | > + XATTR_MAP_FLAG_LAST; The comment is slightly misleading. This entry must be added in all cases since it terminates the lo->xattr_map_list with the XATTR_MAP_FLAG_LAST flag. If we don't add this entry then free_xattrmap() will iterate beyond the end of lo->xattr_map_list. Another approach is to set XATTR_MAP_FLAG_LAST in add_xattrmap_entry() (and clear it on the previous last entry). That way adding the 'bad' catch-all truly is optional and just for cases where the user hasn't defined a catch-all rule themselves. > + tmp_entry.key = g_strdup(""); > + tmp_entry.prepend = g_strdup(""); > + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, > + &tmp_entry); > + > + return res; > +} > + > static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name, > size_t size) > { > @@ -2806,6 +2979,8 @@ static void fuse_lo_data_cleanup(struct lo_data *lo) > close(lo->root.fd); > } > > + free(lo->xattrmap); > + free_xattrmap(lo->xattr_map_list); > free(lo->source); > } > > @@ -2906,6 +3081,11 @@ int main(int argc, char *argv[]) > } else { > lo.source = strdup("/"); > } > + > + if (lo.xattrmap) { > + lo.xattr_map_list = parse_xattrmap(&lo); > + } The function always returns NULL. Has this been tested?
On Wed, Oct 14, 2020 at 07:02:05PM +0100, Dr. David Alan Gilbert (git) wrote: > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > Add an option to define mappings of xattr names so that > the client and server filesystems see different views. > This can be used to have different SELinux mappings as > seen by the guest, to run the virtiofsd with less privileges > (e.g. in a case where it can't set trusted/system/security > xattrs but you want the guest to be able to), or to isolate > multiple users of the same name; e.g. trusted attributes > used by stacking overlayfs. > > A mapping engine is used wit 3 simple rules; the rules can > be combined to allow most useful mapping scenarios. > The ruleset is defined by -o xattrmap='rules...'. > > This patch doesn't use the rule maps yet. > > Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com> > --- > docs/tools/virtiofsd.rst | 54 ++++++++++ > tools/virtiofsd/passthrough_ll.c | 180 +++++++++++++++++++++++++++++++ > 2 files changed, 234 insertions(+) > > diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst > index 7ecee49834..a3a120da2f 100644 > --- a/docs/tools/virtiofsd.rst > +++ b/docs/tools/virtiofsd.rst > @@ -109,6 +109,60 @@ Options > timeout. ``always`` sets a long cache lifetime at the expense of coherency. > The default is ``auto``. > > +xattr-mapping > +------------- > + > +By default the name of xattr's used by the client are passed through to the server > +file system. This can be a problem where either those xattr names are used > +by something on the server (e.g. selinux client/server confusion) or if the > +virtiofsd is running in a container with restricted privileges where it cannot > +access some attributes. > + > +A mapping of xattr names can be made using -o xattrmap=mapping where the ``mapping`` > +string consists of a series of rules. > + > +The first matching rule terminates the mapping. > + > +Each rule consists of a number of fields separated with a separator that is the > +first non-white space character in the rule. This separator must then be used > +for the whole rule. Where is it useful to have a separator other than ":". > +White space may be added before and after each rule. > +Using ':' as the separator a rule is of the form: > + > +``:type:scope:key:prepend:`` > + > +**type** is one of: I am not sure I understand the syntax explanation. So I will ask some basic questions. > + > +- 'prefix' - If 'key' matches the client then the 'prepend' What do you mean by "If key matches the client"? > + is added before the name is passed to the server. Its basically the sever which is processing these rules. I guess you have written this sentence from the perspective of "rule engine" and it passes the name to file server (despite the fact that rule engine itself is part of file server). > + For a server case, the prepend is tested and stripped > + if matching. Is this about file server removing the "prepend" from xattr name before it is sent back to client? > + > +- 'ok' - The attribute name is OK and passed through to > + the server unchanged. > + > +- 'bad' - If a client tries to use this name it's > + denied using EPERM; when the server passes an attribute > + name matching it's hidden. > + > +**scope** is: > + > +- 'client' - match 'key' against a xattr name from the client for > + setxattr/getxattr/removexattr > +- 'server' - match 'prepend' against a xattr name from the server > + for listxattr > +- 'all' - can be used to match both cases. So we need this only if we don't want to do xattr mapping bidirectionally. IOW, server will not allow getxattr "user.foo" but will allow listing "user.foo"? /me is wondering what's the use case of this. > + > +**key** is a string tested as a prefix on an attribute name originating > +on the client. It maybe empty in which case a 'client' rule > +will always match on client names. > + > +**prepend** is a string tested as a prefix on an attribute name originating > +on the server, and used as a new prefix. What does it mean that "prepend" is tested as a prefix" and "used as a new prefix". It is used as a new prefix for client rule, right? Atleast documentation does not make it clear. > It may be empty > +in which case a 'server' rule will always match on all names from > +the server. > + > + > Examples > -------- Can we give some examples in this patch so that it is easy to understand what these rules can allow. Thanks Vivek > > diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c > index ff53df4451..f5a33014f9 100644 > --- a/tools/virtiofsd/passthrough_ll.c > +++ b/tools/virtiofsd/passthrough_ll.c > @@ -64,6 +64,7 @@ > #include <syslog.h> > #include <unistd.h> > > +#include "qemu/cutils.h" > #include "passthrough_helpers.h" > #include "passthrough_seccomp.h" > > @@ -137,6 +138,12 @@ enum { > CACHE_ALWAYS, > }; > > +typedef struct xattr_map_entry { > + char *key; > + char *prepend; > + unsigned int flags; > +} XattrMapEntry; > + > struct lo_data { > pthread_mutex_t mutex; > int debug; > @@ -144,6 +151,7 @@ struct lo_data { > int flock; > int posix_lock; > int xattr; > + char *xattrmap; > char *source; > char *modcaps; > double timeout; > @@ -157,6 +165,7 @@ struct lo_data { > struct lo_map ino_map; /* protected by lo->mutex */ > struct lo_map dirp_map; /* protected by lo->mutex */ > struct lo_map fd_map; /* protected by lo->mutex */ > + XattrMapEntry *xattr_map_list; > > /* An O_PATH file descriptor to /proc/self/fd/ */ > int proc_self_fd; > @@ -172,6 +181,7 @@ static const struct fuse_opt lo_opts[] = { > { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 }, > { "xattr", offsetof(struct lo_data, xattr), 1 }, > { "no_xattr", offsetof(struct lo_data, xattr), 0 }, > + { "xattrmap=%s", offsetof(struct lo_data, xattrmap), 0 }, > { "modcaps=%s", offsetof(struct lo_data, modcaps), 0 }, > { "timeout=%lf", offsetof(struct lo_data, timeout), 0 }, > { "timeout=", offsetof(struct lo_data, timeout_set), 1 }, > @@ -2010,6 +2020,169 @@ static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi, > fuse_reply_err(req, res == -1 ? errno : 0); > } > > +/* > + * Exit; process attribute unmodified if matched. > + * An empty key applies to all. > + */ > +#define XATTR_MAP_FLAG_END_OK (1 << 0) > +/* > + * The attribute is unwanted; > + * EPERM on write hidden on read. > + */ > +#define XATTR_MAP_FLAG_END_BAD (1 << 1) > +/* > + * For attr that start with 'key' prepend 'prepend' > + * 'key' maybe empty to prepend for all attrs > + * key is defined from set/remove point of view. > + * Automatically reversed on read > + */ > +#define XATTR_MAP_FLAG_PREFIX (1 << 2) > +/* Apply rule to get/set/remove */ > +#define XATTR_MAP_FLAG_CLIENT (1 << 16) > +/* Apply rule to list */ > +#define XATTR_MAP_FLAG_SERVER (1 << 17) > +/* Apply rule to all */ > +#define XATTR_MAP_FLAG_ALL (XATTR_MAP_FLAG_SERVER | XATTR_MAP_FLAG_CLIENT) > + > +/* Last rule in the XATTR_MAP */ > +#define XATTR_MAP_FLAG_LAST (1 << 30) > + > +static XattrMapEntry *add_xattrmap_entry(XattrMapEntry *orig_map, > + size_t *nentries, > + const XattrMapEntry *new_entry) > +{ > + XattrMapEntry *res = g_realloc_n(orig_map, ++*nentries, > + sizeof(XattrMapEntry)); > + res[*nentries - 1] = *new_entry; > + > + return res; > +} > + > +static void free_xattrmap(XattrMapEntry *map) > +{ > + XattrMapEntry *curr = map; > + > + if (!map) { > + return; > + }; > + > + do { > + g_free(curr->key); > + g_free(curr->prepend); > + } while (!(curr++->flags & XATTR_MAP_FLAG_LAST)); > + > + g_free(map); > +} > + > +static XattrMapEntry *parse_xattrmap(struct lo_data *lo) > +{ > + XattrMapEntry *res = NULL; > + XattrMapEntry tmp_entry; > + size_t nentries = 0; > + const char *map = lo->xattrmap; > + const char *tmp; > + > + while (*map) { > + char sep; > + > + if (isspace(*map)) { > + map++; > + continue; > + } > + /* The separator is the first non-space of the rule */ > + sep = *map++; > + if (!sep) { > + break; > + } > + > + /* Start of 'type' */ > + if (strstart(map, "prefix", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_PREFIX; > + } else if (strstart(map, "ok", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_END_OK; > + } else if (strstart(map, "bad", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_END_BAD; > + } else { > + fuse_log(FUSE_LOG_ERR, > + "%s: Unexpected type;" > + "Expecting 'prefix', 'ok', or 'bad' in rule %zu\n", > + __func__, nentries); > + exit(1); > + } > + > + if (*map++ != sep) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Missing '%c' at end of type field of rule %zu\n", > + __func__, sep, nentries); > + exit(1); > + } > + > + /* Start of 'scope' */ > + if (strstart(map, "client", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_CLIENT; > + } else if (strstart(map, "server", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_SERVER; > + } else if (strstart(map, "all", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_ALL; > + } else { > + fuse_log(FUSE_LOG_ERR, > + "%s: Unexpected scope;" > + " Expecting 'client', 'server', or 'all', in rule %zu\n", > + __func__, nentries); > + exit(1); > + } > + > + if (*map++ != sep) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Expecting '%c' found '%c'" > + " after scope in rule %zu\n", > + __func__, sep, *map, nentries); > + exit(1); > + } > + > + /* At start of 'key' field */ > + tmp = strchr(map, sep); > + if (!tmp) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Missing '%c' at end of key field of rule %zu", > + __func__, sep, nentries); > + exit(1); > + } > + tmp_entry.key = g_strndup(map, tmp - map); > + map = tmp + 1; > + > + /* At start of 'prepend' field */ > + tmp = strchr(map, sep); > + if (!tmp) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Missing '%c' at end of prepend field of rule %zu", > + __func__, sep, nentries); > + exit(1); > + } > + tmp_entry.prepend = g_strndup(map, tmp - map); > + map = tmp + 1; > + > + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, > + &tmp_entry); > + /* End of rule - go around again for another rule */ > + } > + > + if (!nentries) { > + fuse_log(FUSE_LOG_ERR, "Empty xattr map\n"); > + exit(1); > + } > + > + /* Add a terminator to error in cases the user hasn't specified */ > + tmp_entry.flags = XATTR_MAP_FLAG_ALL | XATTR_MAP_FLAG_END_BAD | > + XATTR_MAP_FLAG_LAST; > + tmp_entry.key = g_strdup(""); > + tmp_entry.prepend = g_strdup(""); > + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, > + &tmp_entry); > + > + return res; > +} > + > static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name, > size_t size) > { > @@ -2806,6 +2979,8 @@ static void fuse_lo_data_cleanup(struct lo_data *lo) > close(lo->root.fd); > } > > + free(lo->xattrmap); > + free_xattrmap(lo->xattr_map_list); > free(lo->source); > } > > @@ -2906,6 +3081,11 @@ int main(int argc, char *argv[]) > } else { > lo.source = strdup("/"); > } > + > + if (lo.xattrmap) { > + lo.xattr_map_list = parse_xattrmap(&lo); > + } > + > if (!lo.timeout_set) { > switch (lo.cache) { > case CACHE_NONE: > -- > 2.28.0 >
* Stefan Hajnoczi (stefanha@redhat.com) wrote: > On Wed, Oct 14, 2020 at 07:02:05PM +0100, Dr. David Alan Gilbert (git) wrote: > > From: "Dr. David Alan Gilbert" <dgilbert@redhat.com> > > > > Add an option to define mappings of xattr names so that > > the client and server filesystems see different views. > > This can be used to have different SELinux mappings as > > seen by the guest, to run the virtiofsd with less privileges > > (e.g. in a case where it can't set trusted/system/security > > xattrs but you want the guest to be able to), or to isolate > > multiple users of the same name; e.g. trusted attributes > > used by stacking overlayfs. > > > > A mapping engine is used wit 3 simple rules; the rules can > > s/wit/with/ Done. > > +``:type:scope:key:prepend:`` > > + > > +**type** is one of: > > + > > +- 'prefix' - If 'key' matches the client then the 'prepend' > > + is added before the name is passed to the server. > > + For a server case, the prepend is tested and stripped > > + if matching. > > It may be clearer to document rule types like this: > > - :prefix:client:key:prepend: - Add 'prepend' before the name if it > starts with 'key'. > > - :prefix:server::prepend: - Strip 'prepend' if the name starts with > it. > > The client vs server behavior is independent so it's clearer to list > them as separate cases. In addition, using the full rule syntax shows > which fields are valid arguments and which ones are ignored. > > The 'all' scope can be documented later as "Combines both the 'client' > and 'server' scope behavior". OK, I've reworked this quite a bit, into a simpler part for each of the type entries with examples of each below. > > + > > +- 'ok' - The attribute name is OK and passed through to > > + the server unchanged. > > The documentation isn't explicit but I think the default behavior is to > allow all xattr names? > > What is the purpose of the 'ok' rule? I guess it's to define an > exception to a later 'prefix' or 'bad' rule. It would be nice to make > this clear. > > The documentation only mentions :client: behavior, leaving :server: > undefined. Please indicate whether this rule has an effect in server > scope. What I have now is: +**scope** is: + +- 'client' - match 'key' against a xattr name from the client for + setxattr/getxattr/removexattr +- 'server' - match 'prepend' against a xattr name from the server + for listxattr +- 'all' - can be used to make a single rule where both the server + and client matches are triggered. + +**type** is one of: + +- 'prefix' - is designed to prepend and strip a prefix; the modified + attributes then being passed on to the client/server. + +- 'ok' - Causes the rule set to be terminated when a match is found + while allowing matching xattr's through unchanged. + It is intended both as a way of explicitly terminating + the list of rules, and to allow some xattr's to skip following rules. + +- 'bad' - If a client tries to use a name matching 'key' it's + denied using EPERM; when the server passes an attribute + name matching 'prepend' it's hidden. In many ways it's use is very like + 'ok' as either an explict terminator or for special handling of certain + patterns. + +**key** is a string tested as a prefix on an attribute name originating +on the client. It maybe empty in which case a 'client' rule +will always match on client names. + +**prepend** is a string tested as a prefix on an attribute name originating +on the server, and used as a new prefix. It may be empty +in which case a 'server' rule will always match on all names from +the server. + +e.g.: + + ``:prefix:client:trusted.:user.virtiofs.:`` + + will match 'trusted.' attributes in client calls and prefix them before + passing them to the server. + + ``:prefix:server::user.virtiofs.:`` + + will strip 'user.virtiofs.' from all server replies. + + ``:prefix:all:trusted.:user.virtiofs.:`` + + combines the previous two cases into a single rule. + + ``:ok:client:user.::`` + + will allow get/set xattr for 'user.' xattr's and ignore + following rules. + + ``:ok:server::security.:`` + + will pass 'securty.' xattr's in listxattr from the server + and ignore following rules. + + ``:ok:all:::`` + + will terminate the rule search passing any remaining attributes + in both directions. + + ``:bad:server::security.:`` + + would hide 'security.' xattr's in listxattr from the server. so I'm hoping that addresses both the prefix and OK sections at least. > > + > > +- 'bad' - If a client tries to use this name it's > > + denied using EPERM; when the server passes an attribute > > + name matching it's hidden. > > + > > +**scope** is: > > + > > +- 'client' - match 'key' against a xattr name from the client for > > + setxattr/getxattr/removexattr > > +- 'server' - match 'prepend' against a xattr name from the server > > + for listxattr > > +- 'all' - can be used to match both cases. > > + > > +**key** is a string tested as a prefix on an attribute name originating > > +on the client. It maybe empty in which case a 'client' rule > > +will always match on client names. > > Is there a way to match a full string instead of a prefix (regexp > ^<pattern>$ instead of ^<pattern>)? No there isn't; can you think of a way of representing that in the syntax without making it much more complex? > > @@ -2010,6 +2020,169 @@ static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi, > > fuse_reply_err(req, res == -1 ? errno : 0); > > } > > > > +/* > > + * Exit; process attribute unmodified if matched. > > + * An empty key applies to all. > > + */ > > +#define XATTR_MAP_FLAG_END_OK (1 << 0) > > +/* > > + * The attribute is unwanted; > > + * EPERM on write hidden on read. > > Making this sentence easier to parse: > > s/write hidden/write, hidden/ Done. > > > + */ > > +#define XATTR_MAP_FLAG_END_BAD (1 << 1) > > +/* > > + * For attr that start with 'key' prepend 'prepend' > > + * 'key' maybe empty to prepend for all attrs > > s/maybe/may be/ Hmm OK. > > + /* Add a terminator to error in cases the user hasn't specified */ > > + tmp_entry.flags = XATTR_MAP_FLAG_ALL | XATTR_MAP_FLAG_END_BAD | > > + XATTR_MAP_FLAG_LAST; > > The comment is slightly misleading. This entry must be added in all > cases since it terminates the lo->xattr_map_list with the > XATTR_MAP_FLAG_LAST flag. If we don't add this entry then > free_xattrmap() will iterate beyond the end of lo->xattr_map_list. > > Another approach is to set XATTR_MAP_FLAG_LAST in add_xattrmap_entry() > (and clear it on the previous last entry). That way adding the 'bad' > catch-all truly is optional and just for cases where the user hasn't > defined a catch-all rule themselves. I've changed the comment. > > + tmp_entry.key = g_strdup(""); > > + tmp_entry.prepend = g_strdup(""); > > + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, > > + &tmp_entry); > > + > > + return res; > > +} > > + > > static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name, > > size_t size) > > { > > @@ -2806,6 +2979,8 @@ static void fuse_lo_data_cleanup(struct lo_data *lo) > > close(lo->root.fd); > > } > > > > + free(lo->xattrmap); > > + free_xattrmap(lo->xattr_map_list); > > free(lo->source); > > } > > > > @@ -2906,6 +3081,11 @@ int main(int argc, char *argv[]) > > } else { > > lo.source = strdup("/"); > > } > > + > > + if (lo.xattrmap) { > > + lo.xattr_map_list = parse_xattrmap(&lo); > > + } > > The function always returns NULL. Has this been tested? Hmm; I moved that xattr_map_list late and only retested with the 'map' shortcut which still returned it. Fixed. Dave -- Dr. David Alan Gilbert / dgilbert@redhat.com / Manchester, UK
On Wed, Oct 14, 2020 at 07:02:05PM +0100, Dr. David Alan Gilbert (git) wrote: [..] > +/* > + * Exit; process attribute unmodified if matched. > + * An empty key applies to all. > + */ > +#define XATTR_MAP_FLAG_END_OK (1 << 0) > +/* > + * The attribute is unwanted; > + * EPERM on write hidden on read. > + */ > +#define XATTR_MAP_FLAG_END_BAD (1 << 1) > +/* > + * For attr that start with 'key' prepend 'prepend' > + * 'key' maybe empty to prepend for all attrs > + * key is defined from set/remove point of view. > + * Automatically reversed on read > + */ > +#define XATTR_MAP_FLAG_PREFIX (1 << 2) > +/* Apply rule to get/set/remove */ > +#define XATTR_MAP_FLAG_CLIENT (1 << 16) > +/* Apply rule to list */ > +#define XATTR_MAP_FLAG_SERVER (1 << 17) > +/* Apply rule to all */ > +#define XATTR_MAP_FLAG_ALL (XATTR_MAP_FLAG_SERVER | XATTR_MAP_FLAG_CLIENT) > + > +/* Last rule in the XATTR_MAP */ > +#define XATTR_MAP_FLAG_LAST (1 << 30) I see that you are using bit positions for flags. Not clear why you used bit 0,1,2 and then jumped to 16,17 and then to 30. May be you are doing some sort of reservation of bits. Will be nice to explain that a bit so that next person modifying it can use bits from correct pool. > + > +static XattrMapEntry *add_xattrmap_entry(XattrMapEntry *orig_map, > + size_t *nentries, > + const XattrMapEntry *new_entry) > +{ > + XattrMapEntry *res = g_realloc_n(orig_map, ++*nentries, > + sizeof(XattrMapEntry)); > + res[*nentries - 1] = *new_entry; > + > + return res; > +} > + > +static void free_xattrmap(XattrMapEntry *map) > +{ > + XattrMapEntry *curr = map; > + > + if (!map) { > + return; > + }; ; after } is not needed. > + > + do { > + g_free(curr->key); > + g_free(curr->prepend); > + } while (!(curr++->flags & XATTR_MAP_FLAG_LAST)); > + > + g_free(map); > +} > + > +static XattrMapEntry *parse_xattrmap(struct lo_data *lo) > +{ > + XattrMapEntry *res = NULL; > + XattrMapEntry tmp_entry; > + size_t nentries = 0; If you are calculating number of entries (nentries), may be this could be stored in lo_data so that can be later used to free entries or loop through rules etc. > + const char *map = lo->xattrmap; > + const char *tmp; > + > + while (*map) { > + char sep; > + > + if (isspace(*map)) { > + map++; > + continue; > + } > + /* The separator is the first non-space of the rule */ > + sep = *map++; > + if (!sep) { > + break; > + } When can sep be NULL? In that case while loop will not even continue. > + > + /* Start of 'type' */ > + if (strstart(map, "prefix", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_PREFIX; > + } else if (strstart(map, "ok", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_END_OK; > + } else if (strstart(map, "bad", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_END_BAD; > + } else { > + fuse_log(FUSE_LOG_ERR, > + "%s: Unexpected type;" > + "Expecting 'prefix', 'ok', or 'bad' in rule %zu\n", > + __func__, nentries); > + exit(1); > + } > + > + if (*map++ != sep) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Missing '%c' at end of type field of rule %zu\n", > + __func__, sep, nentries); > + exit(1); > + } > + > + /* Start of 'scope' */ > + if (strstart(map, "client", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_CLIENT; > + } else if (strstart(map, "server", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_SERVER; > + } else if (strstart(map, "all", &map)) { > + tmp_entry.flags |= XATTR_MAP_FLAG_ALL; > + } else { > + fuse_log(FUSE_LOG_ERR, > + "%s: Unexpected scope;" > + " Expecting 'client', 'server', or 'all', in rule %zu\n", > + __func__, nentries); > + exit(1); > + } > + > + if (*map++ != sep) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Expecting '%c' found '%c'" > + " after scope in rule %zu\n", > + __func__, sep, *map, nentries); > + exit(1); > + } > + > + /* At start of 'key' field */ > + tmp = strchr(map, sep); > + if (!tmp) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Missing '%c' at end of key field of rule %zu", > + __func__, sep, nentries); > + exit(1); > + } > + tmp_entry.key = g_strndup(map, tmp - map); > + map = tmp + 1; > + > + /* At start of 'prepend' field */ > + tmp = strchr(map, sep); > + if (!tmp) { > + fuse_log(FUSE_LOG_ERR, > + "%s: Missing '%c' at end of prepend field of rule %zu", > + __func__, sep, nentries); > + exit(1); > + } > + tmp_entry.prepend = g_strndup(map, tmp - map); > + map = tmp + 1; > + > + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, > + &tmp_entry); > + /* End of rule - go around again for another rule */ > + } > + > + if (!nentries) { > + fuse_log(FUSE_LOG_ERR, "Empty xattr map\n"); > + exit(1); > + } > + > + /* Add a terminator to error in cases the user hasn't specified */ > + tmp_entry.flags = XATTR_MAP_FLAG_ALL | XATTR_MAP_FLAG_END_BAD | > + XATTR_MAP_FLAG_LAST; > + tmp_entry.key = g_strdup(""); > + tmp_entry.prepend = g_strdup(""); > + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, > + &tmp_entry); Not sure why this default rule is needed when user has not specified one. This seems to be equivalent of ":bad:all:::". Will this not block all the xattrs which have not been caught by previous rules. And user probably did not want it. Thanks Vivek
diff --git a/docs/tools/virtiofsd.rst b/docs/tools/virtiofsd.rst index 7ecee49834..a3a120da2f 100644 --- a/docs/tools/virtiofsd.rst +++ b/docs/tools/virtiofsd.rst @@ -109,6 +109,60 @@ Options timeout. ``always`` sets a long cache lifetime at the expense of coherency. The default is ``auto``. +xattr-mapping +------------- + +By default the name of xattr's used by the client are passed through to the server +file system. This can be a problem where either those xattr names are used +by something on the server (e.g. selinux client/server confusion) or if the +virtiofsd is running in a container with restricted privileges where it cannot +access some attributes. + +A mapping of xattr names can be made using -o xattrmap=mapping where the ``mapping`` +string consists of a series of rules. + +The first matching rule terminates the mapping. + +Each rule consists of a number of fields separated with a separator that is the +first non-white space character in the rule. This separator must then be used +for the whole rule. +White space may be added before and after each rule. +Using ':' as the separator a rule is of the form: + +``:type:scope:key:prepend:`` + +**type** is one of: + +- 'prefix' - If 'key' matches the client then the 'prepend' + is added before the name is passed to the server. + For a server case, the prepend is tested and stripped + if matching. + +- 'ok' - The attribute name is OK and passed through to + the server unchanged. + +- 'bad' - If a client tries to use this name it's + denied using EPERM; when the server passes an attribute + name matching it's hidden. + +**scope** is: + +- 'client' - match 'key' against a xattr name from the client for + setxattr/getxattr/removexattr +- 'server' - match 'prepend' against a xattr name from the server + for listxattr +- 'all' - can be used to match both cases. + +**key** is a string tested as a prefix on an attribute name originating +on the client. It maybe empty in which case a 'client' rule +will always match on client names. + +**prepend** is a string tested as a prefix on an attribute name originating +on the server, and used as a new prefix. It may be empty +in which case a 'server' rule will always match on all names from +the server. + + Examples -------- diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c index ff53df4451..f5a33014f9 100644 --- a/tools/virtiofsd/passthrough_ll.c +++ b/tools/virtiofsd/passthrough_ll.c @@ -64,6 +64,7 @@ #include <syslog.h> #include <unistd.h> +#include "qemu/cutils.h" #include "passthrough_helpers.h" #include "passthrough_seccomp.h" @@ -137,6 +138,12 @@ enum { CACHE_ALWAYS, }; +typedef struct xattr_map_entry { + char *key; + char *prepend; + unsigned int flags; +} XattrMapEntry; + struct lo_data { pthread_mutex_t mutex; int debug; @@ -144,6 +151,7 @@ struct lo_data { int flock; int posix_lock; int xattr; + char *xattrmap; char *source; char *modcaps; double timeout; @@ -157,6 +165,7 @@ struct lo_data { struct lo_map ino_map; /* protected by lo->mutex */ struct lo_map dirp_map; /* protected by lo->mutex */ struct lo_map fd_map; /* protected by lo->mutex */ + XattrMapEntry *xattr_map_list; /* An O_PATH file descriptor to /proc/self/fd/ */ int proc_self_fd; @@ -172,6 +181,7 @@ static const struct fuse_opt lo_opts[] = { { "no_posix_lock", offsetof(struct lo_data, posix_lock), 0 }, { "xattr", offsetof(struct lo_data, xattr), 1 }, { "no_xattr", offsetof(struct lo_data, xattr), 0 }, + { "xattrmap=%s", offsetof(struct lo_data, xattrmap), 0 }, { "modcaps=%s", offsetof(struct lo_data, modcaps), 0 }, { "timeout=%lf", offsetof(struct lo_data, timeout), 0 }, { "timeout=", offsetof(struct lo_data, timeout_set), 1 }, @@ -2010,6 +2020,169 @@ static void lo_flock(fuse_req_t req, fuse_ino_t ino, struct fuse_file_info *fi, fuse_reply_err(req, res == -1 ? errno : 0); } +/* + * Exit; process attribute unmodified if matched. + * An empty key applies to all. + */ +#define XATTR_MAP_FLAG_END_OK (1 << 0) +/* + * The attribute is unwanted; + * EPERM on write hidden on read. + */ +#define XATTR_MAP_FLAG_END_BAD (1 << 1) +/* + * For attr that start with 'key' prepend 'prepend' + * 'key' maybe empty to prepend for all attrs + * key is defined from set/remove point of view. + * Automatically reversed on read + */ +#define XATTR_MAP_FLAG_PREFIX (1 << 2) +/* Apply rule to get/set/remove */ +#define XATTR_MAP_FLAG_CLIENT (1 << 16) +/* Apply rule to list */ +#define XATTR_MAP_FLAG_SERVER (1 << 17) +/* Apply rule to all */ +#define XATTR_MAP_FLAG_ALL (XATTR_MAP_FLAG_SERVER | XATTR_MAP_FLAG_CLIENT) + +/* Last rule in the XATTR_MAP */ +#define XATTR_MAP_FLAG_LAST (1 << 30) + +static XattrMapEntry *add_xattrmap_entry(XattrMapEntry *orig_map, + size_t *nentries, + const XattrMapEntry *new_entry) +{ + XattrMapEntry *res = g_realloc_n(orig_map, ++*nentries, + sizeof(XattrMapEntry)); + res[*nentries - 1] = *new_entry; + + return res; +} + +static void free_xattrmap(XattrMapEntry *map) +{ + XattrMapEntry *curr = map; + + if (!map) { + return; + }; + + do { + g_free(curr->key); + g_free(curr->prepend); + } while (!(curr++->flags & XATTR_MAP_FLAG_LAST)); + + g_free(map); +} + +static XattrMapEntry *parse_xattrmap(struct lo_data *lo) +{ + XattrMapEntry *res = NULL; + XattrMapEntry tmp_entry; + size_t nentries = 0; + const char *map = lo->xattrmap; + const char *tmp; + + while (*map) { + char sep; + + if (isspace(*map)) { + map++; + continue; + } + /* The separator is the first non-space of the rule */ + sep = *map++; + if (!sep) { + break; + } + + /* Start of 'type' */ + if (strstart(map, "prefix", &map)) { + tmp_entry.flags |= XATTR_MAP_FLAG_PREFIX; + } else if (strstart(map, "ok", &map)) { + tmp_entry.flags |= XATTR_MAP_FLAG_END_OK; + } else if (strstart(map, "bad", &map)) { + tmp_entry.flags |= XATTR_MAP_FLAG_END_BAD; + } else { + fuse_log(FUSE_LOG_ERR, + "%s: Unexpected type;" + "Expecting 'prefix', 'ok', or 'bad' in rule %zu\n", + __func__, nentries); + exit(1); + } + + if (*map++ != sep) { + fuse_log(FUSE_LOG_ERR, + "%s: Missing '%c' at end of type field of rule %zu\n", + __func__, sep, nentries); + exit(1); + } + + /* Start of 'scope' */ + if (strstart(map, "client", &map)) { + tmp_entry.flags |= XATTR_MAP_FLAG_CLIENT; + } else if (strstart(map, "server", &map)) { + tmp_entry.flags |= XATTR_MAP_FLAG_SERVER; + } else if (strstart(map, "all", &map)) { + tmp_entry.flags |= XATTR_MAP_FLAG_ALL; + } else { + fuse_log(FUSE_LOG_ERR, + "%s: Unexpected scope;" + " Expecting 'client', 'server', or 'all', in rule %zu\n", + __func__, nentries); + exit(1); + } + + if (*map++ != sep) { + fuse_log(FUSE_LOG_ERR, + "%s: Expecting '%c' found '%c'" + " after scope in rule %zu\n", + __func__, sep, *map, nentries); + exit(1); + } + + /* At start of 'key' field */ + tmp = strchr(map, sep); + if (!tmp) { + fuse_log(FUSE_LOG_ERR, + "%s: Missing '%c' at end of key field of rule %zu", + __func__, sep, nentries); + exit(1); + } + tmp_entry.key = g_strndup(map, tmp - map); + map = tmp + 1; + + /* At start of 'prepend' field */ + tmp = strchr(map, sep); + if (!tmp) { + fuse_log(FUSE_LOG_ERR, + "%s: Missing '%c' at end of prepend field of rule %zu", + __func__, sep, nentries); + exit(1); + } + tmp_entry.prepend = g_strndup(map, tmp - map); + map = tmp + 1; + + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, + &tmp_entry); + /* End of rule - go around again for another rule */ + } + + if (!nentries) { + fuse_log(FUSE_LOG_ERR, "Empty xattr map\n"); + exit(1); + } + + /* Add a terminator to error in cases the user hasn't specified */ + tmp_entry.flags = XATTR_MAP_FLAG_ALL | XATTR_MAP_FLAG_END_BAD | + XATTR_MAP_FLAG_LAST; + tmp_entry.key = g_strdup(""); + tmp_entry.prepend = g_strdup(""); + lo->xattr_map_list = add_xattrmap_entry(lo->xattr_map_list, &nentries, + &tmp_entry); + + return res; +} + static void lo_getxattr(fuse_req_t req, fuse_ino_t ino, const char *name, size_t size) { @@ -2806,6 +2979,8 @@ static void fuse_lo_data_cleanup(struct lo_data *lo) close(lo->root.fd); } + free(lo->xattrmap); + free_xattrmap(lo->xattr_map_list); free(lo->source); } @@ -2906,6 +3081,11 @@ int main(int argc, char *argv[]) } else { lo.source = strdup("/"); } + + if (lo.xattrmap) { + lo.xattr_map_list = parse_xattrmap(&lo); + } + if (!lo.timeout_set) { switch (lo.cache) { case CACHE_NONE: