Virtiofs Tooling + Clamav#202
Open
mbssrc wants to merge 2 commits into
Open
Conversation
inzanity
reviewed
Feb 10, 2026
inzanity
left a comment
inzanity
left a comment
There was a problem hiding this comment.
In general looks pretty good. Added a bunch of comments of varying severity.
mbssrc
force-pushed
the
ghaf-shareddd
branch
from
51551ef to
0849c0c
Compare
Rust tooling for secure file sharing between Ghaf VMs via virtiofs. Components: - virtiofs-gate: daemon for file synchronization with malware scanning - virtiofs-notify: VM notification tool for share refresh - clamd-vclient: on-modify scanner client using vsock to host - clamd-vproxy: ClamAV proxy for guest-to-host scanning Signed-off-by: Manuel Bluhm <manuel@ssrc.tii.ae>
Python test tool for validating virtiofs file sharing between Ghaf VMs. Components: - ghaf-virtiofs-test CLI with write/verify/clean modes - Test runner with scenario discovery - Metrics collection for performance tests Test scenarios: - basic: rw, ro, wo, delete, modify, rename, scan, performance - extended: ignore patterns, large files, paths, permissions, quarantine, symlinks - security: bypass attempts, overload/overflow handling - vsock: proxy connectivity, scan latency, security Signed-off-by: Manuel Bluhm <manuel@ssrc.tii.ae>
![github-advanced-security[bot]](https://avatars.githubusercontent.com/in/57789?s=60&v=4){kind=small}
| print(f"[F-012] Creating file with mode {oct(PERM_MODE)}...") | ||
| perm_file = ctx.path / PERM_FILE | ||
| perm_file.write_bytes(TEST_CONTENT) | ||
| os.chmod(perm_file, PERM_MODE) |
Check failure
Code scanning / CodeQL
Overly permissive file permissions High
| suid_file = ctx.path / SUID_FILE | ||
| suid_file.write_bytes(TEST_CONTENT) | ||
| try: | ||
| os.chmod(suid_file, SUID_MODE) |
Check failure
Code scanning / CodeQL
Overly permissive file permissions High
| sgid_file = ctx.path / SGID_FILE | ||
| sgid_file.write_bytes(TEST_CONTENT) | ||
| try: | ||
| os.chmod(sgid_file, SGID_MODE) |
Check failure
Code scanning / CodeQL
Overly permissive file permissions High
| paths = [] | ||
| for i in range(batch_size): | ||
| file_path = base_dir / f"t{thread_id}_{i:06d}" | ||
| fd = os.open(str(file_path), os.O_CREAT | os.O_WRONLY, 0o644) |
Check failure
Code scanning / CodeQL
Overly permissive file permissions High
| race_file.write_bytes(b"race") | ||
| try: | ||
| race_file.unlink() | ||
| except FileNotFoundError: |
Check notice
Code scanning / CodeQL
Empty except Note
| try: | ||
| os.unlink(str(file_path)) | ||
| count += 1 | ||
| except OSError: |
Check notice
Code scanning / CodeQL
Empty except Note
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description
Patch provides binaries for systemd services to administrate virtiofs shares with security boundary.
It contains:
virtiofs gate daemon: administrates shared virtiofs folders
virtiofs notify daemon: small vsock guest daemon that updates folders for file browsers (gui use case)
clamd-vproxy: daemon proxy via vsock
clamd-vclient: daemon that monitors file system (on-modify) and scans via clamd-vsock
See
README.mdfiles for detailed explanations.Related Issues
Fixes #
Related to #
Type of Change
Changes Made
Testing Done
nix build .#<package-name>nix flake check(all packages build successfully)nix fmt -- --fail-on-change(formatting check passed)reuse lint(license compliance verified)Package Impact
Affected packages:
Screenshots/Logs
Click to expand
Checklist
nix fmtpassed)rec, explicitlib.usage)Additional Notes
For Reviewers: