Re: Qemu 9pfs sftp chrootdirectory option issue

[john doe <johndoe65534@mail.com>]

On 10/28/2020 8:00 PM, john doe wrote:
> On 10/28/2020 7:50 PM, Markus Schönhaber wrote:
> > 28.10.20, 19:19 +0100 john doe:
> >
> > > On 10/28/2020 6:51 PM, Markus Schönhaber wrote:
> > > > 28.10.20, 18:30 +0100 john doe:
> > >
> > > > > $ ls -dl /srv/sftp/9p
> > > > > drwx------ 8 root root ... /srv/sftp/9p
> > > >
> > > > Isn't "9p" supposed to be the share directory? If it is, why is it
> > > > owned
> > > > by root and has these restrictive permissions?
> > >
> > > Because of the chrootdirectory directive (see above).
> >
> > That's why I suggested (twice!) to set the ChrootDirectory to the
> > directory that *contains* the share directory.
> >
> > > > Assuming
> > > > ChrootDirectory -> /srv/sftp -> make this root:root, drwxr-xr-x
> > > > share -> /srv/sftp/9p -> make this libvirt-qemu:libvirt-qemu,
> > > > drwxr-xr-x
> > >
> > > If I do that, I can't even connect to the sftp server:
> > >
> > > $ sftp sftp9p
> > > packet_write_wait: Connection to ::1 port 22: Broken pipe
> > > Connection closed
> >
> > The logs will probably tell you what exactly is wrong.
>
> Yes the cause of this message is explained by the fatal message
> mentioned in my privious e-mail.
>
> As I'm not able to properly describe the issue I'm facing I will need to
> come at this from an other angle.
>
> Thanks anyway for your help.

I managed to get it working by pointing the 'chrootdirective' to a root
own directory, then by mounting the 9p share in a subdirectory of that
directory.
I use the '-d' option to the 'internal-sftp' to make it transparent to
the users connecting to that VM.:


$ cat /etc/ssh/sshd_config
Match ...
        ChrootDirectory /mnt/sftp
        ForceCommand internal-sftp -d sftp

$ls -dl /mnt/sftp
drwxr-xr-x 3 root root 4096 ... /mnt/sftp

$ cat /etc/fstab
sftp_dir /mnt/sftp/sftp 9p trans=virtio,version=9p2000.L

$ ls -dl /mnt/sftp/sftp
drwxr-xrwx 2 64055 64055 4096 ... /mnt/sftp/sftp

Note that I still have not figured out why I need to sed the permission
for 'other' to 'rwx' for it to work or how to restrict access to the
share to a specific 'group'.


On the host I would invoke virt-install as follow:

virt-install --filesystem
type=mount,mode=mapped,source=/mnt/sftp,target=sftp_dir


Thanks to 'Markus Schönhaber <debian-user@list-post.mks-mail.de>' for
his input and for putting me on the right track.

--
John Doe