virtiofs mounted filesystems & SELinux

[Link Dupont]

Adding the <binary xattr='on'> element to the <filesystem> device does 
seem to spawn virtiofsd with the option string "source=/home,xattr". My 
guest can no longer mount the device though.

It errors with:

[ 170.225553] 9pnet_virtio: no channels available
mount: mount(2) failed: No such file or directory

I think what this is doing is causing libvirt to create the device as a 
virtiofs device instead of a 9p device. The EL7 kernel doesn't have a 
virtiofs driver, so it can't mount virtiofs devices.

My knowledge is unfortunately limited about the nuances between 9p and 
virtiofs. So I'm mostly experimenting by trial-and-error here.

On Wed, Jun 2 2021 at 03:55:40 PM -0500, Connor Kuehl 
<ckuehl at redhat.com> wrote:
> On 5/21/21 11:59 AM, Link Dupont wrote:
> 
> Adding the virtio-fs mailing list.
> 
>>  I am mounting a filesystem into a domain using the virtiofs driver.
>> 
>>  <filesystem accessmode="passthrough" type="mount">
>>        <source dir="/home"/>
>>        <target dir="/home"/>
>>        <driver type="virtiofs"/>
>>  </filesystem>
>> 
>>  Both my host (Fedora 34) and guest (CentOS 8.4) are running with 
>> SELinux
>>  enforcing. From my host, I can see that the SELinux context type is 
>> set to
>>  user_home_dir_t.
>> 
>>  $ ls -ldZ /home/link
>>  drwxr-xr-x. 61 link link system_u:object_r:user_home_dir_t:s0 8192 
>> May 21
>>  12:41 /home/link
>> 
>>> From within the guest however, the volume is unlabeled_t
>> 
>>  $ ls -lZd /home/link
>>  drwxr-xr-x. 61 link link system_u:object_r:unlabeled_t:s0 8192 May 
>> 21 12:53 /
>>  home/link
>> 
>>  Is there a way to pass the SELinux context through to the guest? Or 
>> mount the
>>  volume with the correct options to map SELinux contexts?
>> 
>> 
> 
> Hi,
> 
> I'm afraid I actually don't know that much about SELinux but I read
> that it relies on using extended attributes in the file system to
> accomplish its labeling.
> 
> Do you still experience this issue when you enable extended attribute
> support[1] in virtiofsd? The example in the optional parameters 
> snippet
> enables extended attributes with the xattr='on' element.
> 
> Connor
> 
> [1] https://libvirt.org/kbase/virtiofs.html#optional-parameters
>