Questions[9p](server)

I am trying to set up a shared folder using the 9p protocol for a kvm/qemu VM that runs on the user session (so the qemu process runs as me, not as root). Mounting the shared folder in guest works fine, I can see and read all files, but I cannot create new or change existing files. This results simply in "permission denied" as if i had no write permissions to the files, although ls -l in the guest confirms I should.

I know it is a SELinux labelling problem on the host. When I set SELinux to permissive mode using setenforce 0, creating and changing files works fine. I also figured out I need to set an appropriate label for the shared folder on the host. What I cannot figure out is what the correct label is. I seem to be missin the correct label, and I also believe MCS is playing a role here.

What I currently have:

[root@host]# semanage fcontext -l |grep simon
/home/simon/Documents/shared_folder(/.*)? all files          unconfined_u:object_r:virt_content_t:s0 

Here's what the qemu process has:

[simon@host]$ ps -elfyZ|grep qemu
unconfined_u:unconfined_r:svirt_t:s0:c317,c827 S simon 12347 3560  1 80 0 552552 2413575 - 10:11 ?      00:00:15 /usr/bin/qemu-system-x86_64 -name guest=debian10-dev_default... (lots of flags)

On the guest I have:

vagrant@debian-10:/vagrant$ whoami
vagrant

vagrant@debian-10:/vagrant$ ls -la /vagrant
total 24
drwxrwxr-x  3 vagrant vagrant 4096 Feb 13 09:12 .
drwxr-xr-x 20 root    root    4096 Jan 31 19:26 ..
drwxrwxr-x  4 vagrant vagrant 4096 Jan 22 16:20 .vagrant
-rw-rw-r--  1 vagrant vagrant 1186 Feb 13 09:10 Vagrantfile

vagrant@debian-10:/vagrant$ mount | grep 9p
4ef5af6232a6a6d0dbdc1b2b9199253 on /vagrant type 9p (rw,relatime,sync,dirsync,access=1000,trans=virtio)

User ID 1000 is simon's user ID on the host. The host runs Fedora Workstation 32, the guest is Debian 10.

Any help is greatly appreciated!

I am using libvirt with qemu on a debian host. One virtual machine has a 9p mount point defined:

<filesystem type='mount' accessmode='mapped'>
  <source dir='/mnt/pool/share'/>
  <target dir='share'/>
  <address type='pci' domain='0x0000' bus='0x06' slot='0x00' function='0x0'/>
</filesystem>

The default apparmor configuration (which is apparently created by virt-aa-helper) does not allow me to create hard links on the 9p volume.

I made it work by adding the following line to /etc/apparmor.d/abstractions/libvirt-qemu

  "/mnt/pool/share/**" rwl,

This works but has the following problems:

1. It allows all hosts to read/write to this directory, not only the one host I need
2. It requires editing a conffile that is regularly updated which is probably not a good idea because it makes updates to the debian package harder
3. It is not configured in the libvirt xml file which makes portability harder and is one extra step

Is there a better way?

I have a strange problem. Iam trying to create a shared folder via the add-hardware->filesystem option. For Type and Modus i choose Passtrought and for Driver Path. The Source Path is /free and target is mytag. I mount it with: mount -t 9p -o trans=virtio mytag /mnt/test -oversion=9p2000.L Everything worked without problems. But when i enter /mnt/test and do a ls, i get "ls: Öffnen von Verzeichnis . nicht möglich: Keine Berechtigung" in english something like "ls: cant open folder . no permission"

I set permissions of /free to 777 recursivly but nothing changed. Also tried some other modes in virt-manager but nothing changes. Do you have any clues, what i am doing wrong?

The guest-os ist Ubuntu 12.04 and the host-os is Ubuntu 11.10

Thank you for your help.

First some background information on the server:

Host OS: Debian Linux Squeeze + qemu-kvm version 1.0+dfsg-8~bpo60+1

Guest OS: Debian Linux Squeeze

I use qemu-kvm via libvirt. I have set up 9p VirtFS with the following in Guest's XML config:

<filesystem type='mount' accessmode='passthrough'>
  <source dir='/srv/www'/>
  <target dir='wwwdata'/>
  <address type='pci' domain='0x0000' bus='0x00' slot='0x06' function='0x0'/>
</filesystem>

That is, I want to share /srv/www to the guest OS using mount tag wwwdata.

When I try to mount the VirtFS share from the guest, I get an error message:

root@server:~# mount -t 9p -o trans=virtio,version=9p2000.L2 wwwdata /srv/www/
mount: wwwdata: can't read superblock

I also tried virtfs target dir/mount_tag www at first. I got the same error message. However, I was able to mount the VirtFS share using mount tag www1111, or www1 or similar.

Some more notes on this one. dmesg doesn't show anything useful either in guest or the host. The only sign is this entry in the guest dmesg:

[ 36.054936] Installing v9fs 9p2000 file system support

Does anyone know how to get this working correctly? Google gives no useful information on this issue; I've tried several searches.

I have recently started experimenting with the support for passthrough filesystems in recent versions of KVM/QEMU/libvirt. Making the filesystems available for read access has "just worked", but I'm a little puzzled about how write access is supposed to work. After mounting the filesystem in the guest:

# mount -t 9p -o trans=virtio /fs/data /mnt

I can modify an existing file if it has mode o+w:

# cd /mnt/work
# ls -l foo
-rw-rw-rw-. 1 root root 17 Dec 20 11:16 foo
# cat foo
this is line one
# echo this is line two >> foo
# cat foo
this is line one
this is line two

But regardless of the directory permissions, I cannot create a new file or directory:

# ls -ld /mnt/work
drwxrwxrwx. 2 root root 4096 Dec 20 11:16 /mnt/work
# cd /mnt/work
# touch bar
touch: setting times of `bar': No such file or directory
# mkdir bar
# mkdir: cannot create directory `bar': Operation not permitted

The documentation I've been able to find (e.g., this) does not explicitly address this issue. I'm hoping someone here at Serverfault can help me set up a passthrough filesystem that will let me grant write access to a user in the guest to a host filesystem.