On Thu, Nov 19, 2020 at 01:38:41PM -0500, Vivek Goyal wrote: > On Thu, Nov 19, 2020 at 12:27:20PM -0600, Harry G. Coin wrote: > > > > On 11/19/20 12:16 PM, Vivek Goyal wrote: > > > On Thu, Nov 19, 2020 at 10:52:51AM -0600, Harry G. Coin wrote: > > >> Hello virtiofs team. I need clarification about a 'restorecon' selinux > > >> guest giving an 'operation not supported' response. > > >> > > >> If the host fs is btrfs (with xattr enabled in virtiofsd) but not > > >> running SELinux, > > > I suspect that on host setxattr(security.selinux) is failing with > > > "operation not supported". > > > > > > What do you mean by host "not running SELinux". SElinux is not compiled > > > in? Or it is disabled or in passive mode? > > > > > > Is it working with filesystems other than btrfs, say ext4 or xfs. > > > > > > Now qemu supports xattr remapping. You might want to run virtiofsd > > > to remap security.selinux. I think that might get you going till > > > the root cause of the issue is found. > > > > > > Vivek > > > > Thank you for the focus. The host os in this instance is not from the > > fedora/rhel/centos world with selinux running. My case is a debian > > sourced distro (ubuntu). That world uses 'apparmor' by default, not > > selinux. I think it's reasonable to suppose there are a lot of servers > > out there not running selinux that have lots of vms running on them, not > > all using virtiofs. There should be a documented way to allow the > > 'restorcon' command on one of many guests on such hosts to work. I > > suppose to wrap this up: > > > > For the future readers who got here by searching, could you give the > > first kernel version that supports a non-selinux host supporting an > > selinux enabled guest and the virtiofsd command line necessary to get > > the restorecon command to work normally? > > I don't know yet. Because I don't know what's the root cause of the > issue. > > The way you are explaining it, looks like host kernel somehow is > blocking setxattr(security.selinux). And I have no idea why. Is it > apparmor or something else. > > If no selinux module is loaded on host, then as long as virtiofsd > process has CAP_SYS_ADMIN, it should be able to set security.selinux. > > "Operation not supported" means error "EOPNOTSUP". I am assuming > you are running virtiofsd with "-o xattr" to make sure virtiofsd > supports xattr. If that's the case somehow kernel is returning > "EOPNOTSUP". > > Can you run virtiofsd with debug option -d and try to install that > package in guest and capture outout of virtiofsd and post here. It > might confirm that host kernel is returning error.
I tried doing "chcon unconfined_u:object_r:admin_home_t:s0 bar.txt" on a file in virtiofs and got "Operation not supported". I think guest kernel failed this. Will need to debug further. Vivek _______________________________________________ Virtio-fs mailing list [email protected] https://www.redhat.com/mailman/listinfo/virtio-fs
