From 777f5b67c2dd48b445de457243ee480c4bec7fb3 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Fri, 9 Feb 2024 07:12:44 +0100 Subject: [PATCH 1/9] nixos/qemu-vm: add option to specify security model to use for a shared directory --- nixos/modules/virtualisation/qemu-vm.nix | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 57e2c38301a0..919c0220def6 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -250,7 +250,7 @@ let ${concatStringsSep " " config.virtualisation.qemu.networkingOptions} \ ${concatStringsSep " \\\n " (mapAttrsToList - (tag: share: "-virtfs local,path=${share.source},security_model=none,mount_tag=${tag}") + (tag: share: "-virtfs local,path=${share.source},security_model=${share.securityModel},mount_tag=${tag}") config.virtualisation.sharedDirectories)} \ ${drivesCmdLine config.virtualisation.qemu.drives} \ ${concatStringsSep " \\\n " config.virtualisation.qemu.options} \ @@ -474,6 +474,11 @@ in type = types.path; description = lib.mdDoc "The mount point of the directory inside the virtual machine"; }; + options.securityModel = mkOption { + type = types.enum [ "passthrough" "mapped" "mapped-xattr" "mapped-file" "none" ]; + default = "none"; + description = lib.mdDoc "The security model to use for this share"; + }; }); default = { }; example = { From 200e3a934bec15ed3df2e1510789162cc3bdb904 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Fri, 16 Feb 2024 05:52:12 +0100 Subject: [PATCH 2/9] nixos/qemu-vm: added description of security model options, removed 'mapped' security model Co-authored-by: Michele Guerini Rocco --- nixos/modules/virtualisation/qemu-vm.nix | 11 +++++++++-- 1 file changed, 9 insertions(+), 2 deletions(-) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 919c0220def6..c5c691ed0ff8 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -475,9 +475,16 @@ in description = lib.mdDoc "The mount point of the directory inside the virtual machine"; }; options.securityModel = mkOption { - type = types.enum [ "passthrough" "mapped" "mapped-xattr" "mapped-file" "none" ]; + type = types.enum [ "passthrough" "mapped-xattr" "mapped-file" "none" ]; default = "none"; - description = lib.mdDoc "The security model to use for this share"; + description = lib.mdDoc '' + The security model to use for this share: + + - `passthrough`: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root) + - `mapped-xattr`: some of the file attributes like uid, gid, mode bits and link target are stored as file attributes + - `mapped-file`: the attributes are stored in the hidden .virtfs_metadata directory. Directories exported by this security model cannot interact with other unix tools + - `none`: same as "passthrough" except the sever won't report failures if it fails to set file attributes like ownership + ''; }; }); default = { }; From 2c74da898e44eedde7589c965eb67c35a04504e2 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Fri, 16 Feb 2024 06:26:26 +0100 Subject: [PATCH 3/9] nixos/qemu-vm: changed default security model Changed the default security model for shared directories from 'none' to the 'mapped-xattr'. QEMU recommends using this option for its security and reliability benefits. --- nixos/modules/virtualisation/qemu-vm.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index c5c691ed0ff8..5c41d1f6a6a8 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -476,7 +476,7 @@ in }; options.securityModel = mkOption { type = types.enum [ "passthrough" "mapped-xattr" "mapped-file" "none" ]; - default = "none"; + default = "mapped-xattr"; description = lib.mdDoc '' The security model to use for this share: From a77095a2af0475ed1d4584995eb0ac130bdeabab Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Sat, 17 Feb 2024 07:18:52 +0100 Subject: [PATCH 4/9] nixos/qemu-vm: added security model for shared host nix store Setting security model for shared host nix store to 'none'. Using the default 'mapped-xattr' model results in a kernel panic when running the VM. --- nixos/modules/virtualisation/qemu-vm.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 5c41d1f6a6a8..f839676c24dd 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -1120,6 +1120,7 @@ in nix-store = mkIf cfg.mountHostNixStore { source = builtins.storeDir; target = "/nix/store"; + securityModel = "none"; }; xchg = { source = ''"$TMPDIR"/xchg''; From 5612e8ba7b8c95820ff2a89c9da62dc84e2c55d7 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Fri, 19 Apr 2024 19:03:55 +0200 Subject: [PATCH 5/9] nixos/qemu-vm: removed use of lib.mdDoc MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Co-authored-by: éclairevoyant <848000+eclairevoyant@users.noreply.github.com> --- nixos/modules/virtualisation/qemu-vm.nix | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index f839676c24dd..82b6ff0ee9d6 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -477,7 +477,7 @@ in options.securityModel = mkOption { type = types.enum [ "passthrough" "mapped-xattr" "mapped-file" "none" ]; default = "mapped-xattr"; - description = lib.mdDoc '' + description = '' The security model to use for this share: - `passthrough`: files are stored using the same credentials as they are created on the guest (this requires QEMU to run as root) From 11dfebc306f5bd905c79ead894cbb15366e63932 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Sun, 21 Apr 2024 07:35:44 +0200 Subject: [PATCH 6/9] nixos/qemu-vm: set security model 'none' for shared xchg directory Co-authored-by: Michele Guerini Rocco --- nixos/modules/virtualisation/qemu-vm.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index db2e56c519d8..feddd0230721 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -1107,6 +1107,7 @@ in }; xchg = { source = ''"$TMPDIR"/xchg''; + securityModel = "none"; target = "/tmp/xchg"; }; shared = { From c16ff7f9f3f15723f77d4db13ef6ad6bb7619933 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Mon, 22 Apr 2024 05:41:11 +0200 Subject: [PATCH 7/9] nixos/qemu-vm: set security model for 'xchg' directory to 'none' Co-authored-by: Michele Guerini Rocco --- nixos/modules/virtualisation/qemu-vm.nix | 1 + 1 file changed, 1 insertion(+) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index feddd0230721..2456d6d573e7 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -1108,6 +1108,7 @@ in xchg = { source = ''"$TMPDIR"/xchg''; securityModel = "none"; + securityModel = "none"; target = "/tmp/xchg"; }; shared = { From 7aa7920fb0439c3b9c13a2d39f449beee9c7c9c8 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Mon, 22 Apr 2024 05:49:11 +0200 Subject: [PATCH 8/9] Revert "nixos/qemu-vm: set security model for 'xchg' directory to 'none'" This reverts commit c16ff7f9f3f15723f77d4db13ef6ad6bb7619933. --- nixos/modules/virtualisation/qemu-vm.nix | 1 - 1 file changed, 1 deletion(-) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index 2456d6d573e7..feddd0230721 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -1108,7 +1108,6 @@ in xchg = { source = ''"$TMPDIR"/xchg''; securityModel = "none"; - securityModel = "none"; target = "/tmp/xchg"; }; shared = { From cb46e6864bec508dbfa461d3d5b592bbeb041d25 Mon Sep 17 00:00:00 2001 From: Anders Johan Jamtli Date: Mon, 22 Apr 2024 05:55:58 +0200 Subject: [PATCH 9/9] nixos/qemu-vm: set secrurity model for 'shared' and 'certs' directories to 'none' --- nixos/modules/virtualisation/qemu-vm.nix | 2 ++ 1 file changed, 2 insertions(+) diff --git a/nixos/modules/virtualisation/qemu-vm.nix b/nixos/modules/virtualisation/qemu-vm.nix index feddd0230721..c30f4577fdd8 100644 --- a/nixos/modules/virtualisation/qemu-vm.nix +++ b/nixos/modules/virtualisation/qemu-vm.nix @@ -1113,10 +1113,12 @@ in shared = { source = ''"''${SHARED_DIR:-$TMPDIR/xchg}"''; target = "/tmp/shared"; + securityModel = "none"; }; certs = mkIf cfg.useHostCerts { source = ''"$TMPDIR"/certs''; target = "/etc/ssl/certs"; + securityModel = "none"; }; };