Return to virtfs-proxy-helper.texi CVS log

Up to [Qemu by Fabrice Bellard] / qemu / fsdev

Annotation of qemu/fsdev/virtfs-proxy-helper.texi, revision 1.1

1.1     ! root        1: @example
        !             2: @c man begin SYNOPSIS
        !             3: usage: virtfs-proxy-helper options
        !             4: @c man end
        !             5: @end example
        !             6: 
        !             7: @c man begin DESCRIPTION
        !             8: @table @description
        !             9: Pass-through security model in QEMU 9p server needs root privilege to do
        !            10: few file operations (like chown, chmod to any mode/uid:gid).  There are two
        !            11: issues in pass-through security model
        !            12: 
        !            13: 1) TOCTTOU vulnerability: Following symbolic links in the server could
        !            14: provide access to files beyond 9p export path.
        !            15: 
        !            16: 2) Running QEMU with root privilege could be a security issue.
        !            17: 
        !            18: To overcome above issues, following approach is used: A new filesytem
        !            19: type 'proxy' is introduced. Proxy FS uses chroot + socket combination
        !            20: for securing the vulnerability known with following symbolic links.
        !            21: Intention of adding a new filesystem type is to allow qemu to run
        !            22: in non-root mode, but doing privileged operations using socket IO.
        !            23: 
        !            24: Proxy helper(a stand alone binary part of qemu) is invoked with
        !            25: root privileges. Proxy helper chroots into 9p export path and creates
        !            26: a socket pair or a named socket based on the command line parameter.
        !            27: QEMU and proxy helper communicate using this socket. QEMU proxy fs
        !            28: driver sends filesystem request to proxy helper and receives the
        !            29: response from it.
        !            30: 
        !            31: Proxy helper is designed so that it can drop the root privilege with
        !            32: retaining capbilities needed for doing filesystem operations only.
        !            33: 
        !            34: @end table
        !            35: @c man end
        !            36: 
        !            37: @c man begin OPTIONS
        !            38: The following options are supported:
        !            39: @table @option
        !            40: @item -h
        !            41: @findex -h
        !            42: Display help and exit
        !            43: @item -p|--path path
        !            44: Path to export for proxy filesystem driver
        !            45: @item -f|--fd socket-id
        !            46: Use given file descriptor as socket descriptor for communicating with
        !            47: qemu proxy fs drier. Usually a helper like libvirt will create
        !            48: socketpair and pass one of the fds as parameter to -f|--fd
        !            49: @item -s|--socket socket-file
        !            50: Creates named socket file for communicating with qemu proxy fs driver
        !            51: @item -u|--uid uid -g|--gid gid
        !            52: uid:gid combination to give access to named socket file
        !            53: @item -n|--nodaemon
        !            54: Run as a normal program. By default program will run in daemon mode
        !            55: @end table
        !            56: @c man end
        !            57: 
        !            58: @setfilename virtfs-proxy-helper
        !            59: @settitle QEMU 9p virtfs proxy filesystem helper
        !            60: 
        !            61: @c man begin AUTHOR
        !            62: M. Mohan Kumar
        !            63: @c man end

This archive runs on limited infrastructure. Preserving old code on modern bandwidth. Automated agents are requested to crawl responsibly.