diff options
author | Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> | 2012-01-19 12:21:11 +0530 |
---|---|---|
committer | Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com> | 2012-01-19 12:21:11 +0530 |
commit | 2c30dd744aa02d31a8a3b87daaba0b2cb774f346 (patch) | |
tree | 6546809cbe5e220c5d6710170ff512de265b1566 /qemu-options.hx | |
parent | 8c4ec5c0269bda18bb777a64b2008088d1c632dc (diff) |
hw/9pfs: Add new security model mapped-file.
This enable us to do passthrough equivalent security model on NFS directory.
NFS server mostly do root squashing and don't support xattr. Hence we cannot
use 'passthrough' or 'mapped' security model
Also added "mapped-xattr" security to indicate earlier "mapped" security model
Older name is still supported.
POSIX rules regarding ctime update on chmod are not followed by this security model.
Signed-off-by: Aneesh Kumar K.V <aneesh.kumar@linux.vnet.ibm.com>
Diffstat (limited to 'qemu-options.hx')
-rw-r--r-- | qemu-options.hx | 18 |
1 files changed, 10 insertions, 8 deletions
diff --git a/qemu-options.hx b/qemu-options.hx index 6295cde351..0cefd1852f 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -551,7 +551,7 @@ DEFHEADING() DEFHEADING(File system options:) DEF("fsdev", HAS_ARG, QEMU_OPTION_fsdev, - "-fsdev fsdriver,id=id[,path=path,][security_model={mapped|passthrough|none}]\n" + "-fsdev fsdriver,id=id[,path=path,][security_model={mapped-xattr|mapped-file|passthrough|none}]\n" " [,writeout=immediate][,readonly][,socket=socket|sock_fd=sock_fd]\n", QEMU_ARCH_ALL) @@ -571,12 +571,13 @@ Specifies the export path for the file system device. Files under this path will be available to the 9p client on the guest. @item security_model=@var{security_model} Specifies the security model to be used for this export path. -Supported security models are "passthrough", "mapped" and "none". +Supported security models are "passthrough", "mapped-xattr", "mapped-file" and "none". In "passthrough" security model, files are stored using the same credentials as they are created on the guest. This requires qemu -to run as root. In "mapped" security model, some of the file +to run as root. In "mapped-xattr" security model, some of the file attributes like uid, gid, mode bits and link target are stored as -file attributes. Directories exported by this security model cannot +file attributes. For "mapped-file" these attributes are stored in the +hidden .virtfs_metadata directory. Directories exported by this security model cannot interact with other unix tools. "none" security model is same as passthrough except the sever won't report failures if it fails to set file attributes like ownership. Security model is mandatory @@ -616,7 +617,7 @@ DEFHEADING() DEFHEADING(Virtual File system pass-through options:) DEF("virtfs", HAS_ARG, QEMU_OPTION_virtfs, - "-virtfs local,path=path,mount_tag=tag,security_model=[mapped|passthrough|none]\n" + "-virtfs local,path=path,mount_tag=tag,security_model=[mapped-xattr|mapped-file|passthrough|none]\n" " [,writeout=immediate][,readonly][,socket=socket|sock_fd=sock_fd]\n", QEMU_ARCH_ALL) @@ -637,12 +638,13 @@ Specifies the export path for the file system device. Files under this path will be available to the 9p client on the guest. @item security_model=@var{security_model} Specifies the security model to be used for this export path. -Supported security models are "passthrough", "mapped" and "none". +Supported security models are "passthrough", "mapped-xattr", "mapped-file" and "none". In "passthrough" security model, files are stored using the same credentials as they are created on the guest. This requires qemu -to run as root. In "mapped" security model, some of the file +to run as root. In "mapped-xattr" security model, some of the file attributes like uid, gid, mode bits and link target are stored as -file attributes. Directories exported by this security model cannot +file attributes. For "mapped-file" these attributes are stored in the +hidden .virtfs_metadata directory. Directories exported by this security model cannot interact with other unix tools. "none" security model is same as passthrough except the sever won't report failures if it fails to set file attributes like ownership. Security model is mandatory only |