[Virtio-fs] Effect of nodev, noexec, nosuid mount options (Was: Re: One virtiofs daemon per exported dir requirement)

[Daniel Walsh]

On 2/19/20 9:06 AM, Vivek Goyal wrote:
> On Tue, Feb 18, 2020 at 04:39:07PM -0500, Daniel Walsh wrote:
>
> [..]
>> What about noexec? nodev? nosuid?
> These flags will take affect on host (but not inside guest). These will
> protect host from guest (in case guest process drops some file in shared dir,
> escapes from guest somehow and take over host system).
>
> nodev will make sure even if guest drops a device file in shared dir,
> it can't open it (if running on host directly). If running inside guest,
> it will fail as device will not be in guest to begin with. If matching
> device in guest is available, guest process should be able to open it.

As we discussed in my office, this is unexpected behavior by the user.

I actually believe Kata inside of the container might be able to take
care of

some of these inside of the VM, but we really need to think in the long
run of

propagating this information to the kernel inside of the VM, so it will
act properly.

> nosuid, also will take affect on host. So if guest process drops a setuid
> root bindary and tries to execute it on host, setuid will not take affect.
> But running same setuid binary inside guest will continue to work.
Which as I pointed out above is a problem.
> noexec also takes affect on host. If guest drops an executable in shared
> directory and some process on host tries to execute it, it will fail. But
> if guest tries to execute that file inside guest, it works.
Same issue.
> IOW, all these flags work on host but have no affect inside guest, as of
> now.

Users will not view a virtiofs as a networked protocol.  So at least we
need to document these in

Kata as shortcomings when using virtiofs.

> Thanks
> Vivek