On Sun, 23 Nov 2025 01:19:09 +0500
Andrey Erokhin <[email protected]> wrote:
> Directories attached using virtfs with security-model=mapped
> may contain native symlinks
>
> This can happen e.g. when booting from a rootfs directory tree
> (usually with a writable overlay set up on the host side)
>
> Currently, when security-model=mapped[-xattr|-file],
> QEMU assumes that host-side "symlinks" are in the mapped format,
> i.e. are regular files storing the linked path,
This looks like an unfortunate design choice to start with. The mapped-xattr
mode was introduced to cache client-side uids/gids/mode in extended attributes.
Since there was no support in linux to set extended attributes on symlinks at
the time, 879c28133dfa ("virtio-9p: Security model for symlink and readlink")
opted to convert client originated symlinks into regular files.
A better choice would probably have been to leave symlinks as is and to cache
the metadata in a separate file, a bit like what the mapped-file does.
> so it tries to open with O_NOFOLLOW
> and fails with ELOOP on native symlinks
>
> This patch introduces a fallback for such cases:
> reuse security-model=[none|passthrough] else if branch logic
> where readlink will be called for the path basename
>
> Resolves: https://gitlab.com/qemu-project/qemu/-/issues/173
>
> Signed-off-by: Andrey Erokhin <[email protected]>
> ---
> hw/9pfs/9p-local.c | 4 ++++
> 1 file changed, 4 insertions(+)
>
> diff --git a/hw/9pfs/9p-local.c b/hw/9pfs/9p-local.c
> index 6230466de1..ddf111b674 100644
> --- a/hw/9pfs/9p-local.c
> +++ b/hw/9pfs/9p-local.c
> @@ -474,12 +474,16 @@ static ssize_t local_readlink(FsContext *fs_ctx,
> V9fsPath *fs_path,
>
> fd = local_open_nofollow(fs_ctx, fs_path->data, O_RDONLY, 0);
> if (fd == -1) {
> + if (errno == ELOOP) {
> + goto native_symlink;
> + }
> return -1;
> }
> tsize = RETRY_ON_EINTR(read(fd, (void *)buf, bufsz));
> close_preserve_errno(fd);
> } else if ((fs_ctx->export_flags & V9FS_SM_PASSTHROUGH) ||
> (fs_ctx->export_flags & V9FS_SM_NONE)) {
> + native_symlink:;
Still has the terminating but unneeded semicolon. With that fixed,
Reviewed-by: Greg Kurz <[email protected]>
> char *dirpath = g_path_get_dirname(fs_path->data);
> char *name = g_path_get_basename(fs_path->data);
> int dirfd;
--
Greg
