diff options
| author | Christian Schoenebeck <qemu_oss@crudebyte.com> | 2023-06-26 13:49:06 +0200 |
|---|---|---|
| committer | Christian Schoenebeck <qemu_oss@crudebyte.com> | 2023-07-06 11:42:08 +0200 |
| commit | 71d72ececa086114df80fe4cc04d701b59002eb2 (patch) | |
| tree | 13d1c72b2f6bc3ca59c2ec293107a1e503c0d44c /docs/about/deprecated.rst | |
| parent | 0618e72d64e434dd6f1bc38b107670474c49fb86 (diff) | |
9pfs: deprecate 'proxy' backend
As recent CVE-2023-2861 (fixed by f6b0de53fb) once again showed, the 9p
'proxy' fs driver is in bad shape. Using the 'proxy' backend was already
discouraged for safety reasons before and we recommended to use the
'local' backend (preferably in conjunction with its 'mapped' security
model) instead, but now it is time to officially deprecate the 'proxy'
backend.
Signed-off-by: Christian Schoenebeck <qemu_oss@crudebyte.com>
Reviewed-by: Greg Kurz <groug@kaod.org>
Message-Id: <E1qDkmw-0007M1-8f@lizzy.crudebyte.com>
Diffstat (limited to 'docs/about/deprecated.rst')
| -rw-r--r-- | docs/about/deprecated.rst | 23 |
1 files changed, 23 insertions, 0 deletions
diff --git a/docs/about/deprecated.rst b/docs/about/deprecated.rst index 0743459862..ddc1e48460 100644 --- a/docs/about/deprecated.rst +++ b/docs/about/deprecated.rst @@ -343,6 +343,29 @@ the addition of volatile memory support, it is now necessary to distinguish between persistent and volatile memory backends. As such, memdev is deprecated in favor of persistent-memdev. +``-fsdev proxy`` and ``-virtfs proxy`` (since 8.1) +^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^ + +The 9p ``proxy`` filesystem backend driver has been deprecated and will be +removed (along with its proxy helper daemon) in a future version of QEMU. Please +use ``-fsdev local`` or ``-virtfs local`` for using the 9p ``local`` filesystem +backend, or alternatively consider deploying virtiofsd instead. + +The 9p ``proxy`` backend was originally developed as an alternative to the 9p +``local`` backend. The idea was to enhance security by dispatching actual low +level filesystem operations from 9p server (QEMU process) over to a separate +process (the virtfs-proxy-helper binary). However this alternative never gained +momentum. The proxy backend is much slower than the local backend, hasn't seen +any development in years, and showed to be less secure, especially due to the +fact that its helper daemon must be run as root, whereas with the local backend +QEMU is typically run as unprivileged user and allows to tighten behaviour by +mapping permissions et al by using its 'mapped' security model option. + +Nowadays it would make sense to reimplement the ``proxy`` backend by using +QEMU's ``vhost`` feature, which would eliminate the high latency costs under +which the 9p ``proxy`` backend currently suffers. However as of to date nobody +has indicated plans for such kind of reimplemention unfortunately. + Block device options '''''''''''''''''''' |