Failure with readonly mount on VM

tomp · June 1, 2021, 10:58am

The following PRs ensure that readonly=true disk devices are now truly read-only even when using one of the QEMU proxy daemons to work around AppArmor profile and unprivileged user limitations.

We now use a host-side readonly bind mount of the source directory, which is passed to the virtfs-proxy-helper (for 9p) and virtiofsd (for virtio-fs) shares, providing a “belt and braces” approach by using the Linux kernel itself to enforce readonly access and don’t just rely on QEMU’s security restrictions.

github.com/lxc/lxd

VM: Deduplicate the virtiofsd start and stop logic and simplify disk apparmor rules

lxc:master ← tomponline:tp-vm-shares

opened 03:12PM - 26 May 21 UTC

tomponline

+173 -163

Removes duplicate virtiofsd start and stop logic to centralise the knowledge for… when virtiofsd should be used, rather than duplicating it in both the qemu driver and the disk device packages. - Also centralises the variable generation for the config drive's virtiofsd socket and pid paths. - Also explicitly allows the qemu process r/w access to the instance's devices directory. This is to allow access to the virtiofsd socket, and in the future bind-mounted disk directories themselves. I've allowed access to the whole directory rather than explicitly adding boot-time rules individually to allow us to support hot plugged disks in the future.

And associated test updates:

tomp · June 1, 2021, 11:00am

The reason bind mounting didn’t work for you is because LXD from the SNAP runs inside its own mount namespace and was not seeing the bind mount you setup on the host’s mount namespace. LXD is now going to setup its own bind mount and this will be done inside the SNAP mount namespace and so will take effect.