On Tue, Feb 18, 2020 at 04:39:07PM -0500, Daniel Walsh wrote: [..] > > > What about noexec? nodev? nosuid?
These flags will take affect on host (but not inside guest). These will protect host from guest (in case guest process drops some file in shared dir, escapes from guest somehow and take over host system). nodev will make sure even if guest drops a device file in shared dir, it can't open it (if running on host directly). If running inside guest, it will fail as device will not be in guest to begin with. If matching device in guest is available, guest process should be able to open it. nosuid, also will take affect on host. So if guest process drops a setuid root bindary and tries to execute it on host, setuid will not take affect. But running same setuid binary inside guest will continue to work. noexec also takes affect on host. If guest drops an executable in shared directory and some process on host tries to execute it, it will fail. But if guest tries to execute that file inside guest, it works. IOW, all these flags work on host but have no affect inside guest, as of now. Thanks Vivek _______________________________________________ Virtio-fs mailing list [email protected] https://www.redhat.com/mailman/listinfo/virtio-fs
