Enables block device and disable virtio-fs #11343
Conversation
|
Hey @mythi I have splited the two commits here. PTAL, Thx in advance. |
| } else { | ||
| CapabilityBits::BlockDeviceSupport | ||
| | CapabilityBits::BlockDeviceHotplugSupport | ||
| | CapabilityBits::FsSharingSupport |
There was a problem hiding this comment.
Not related to this patch, but when shared_fs = none is set, we should also make suyre that FsSharingSupport is disabled.
There was a problem hiding this comment.
good cache! What do you think if I move the commit it into this PR ?
There was a problem hiding this comment.
No, no need. Just remember to also adjust the other commit after this one gets merged.
Sounds fair?
There was a problem hiding this comment.
Yeah, sound good to me. Thx
thanks! I'm not familiar with the capability logic so leaving that to others. |
|
@Apokleos - Alex - I think this will need to be rebased to pick up some CI fixes. sorry for the inconvenience. |
Two key important scenarios: (1) Support `virtio-blk-pci` cold plug capability for confidential guests instead of nvdimm device in CVM due to security constraints in CoCo cases. (2) Push initdata payload into compressed raw block device and insert it in CVM through `virtio-blk-pci` cold plug mechanism. Fixes kata-containers#11341 Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
Kata runtime employs a CapabilityBits mechanism for VMM capability governance. Fundamentally, this mechanism utilizes predefined feature flags to manage the VMM's operational boundaries. To meet demands for storage performance and security, it's necessary to explicitly enable capability flags such as `BlockDeviceSupport` (basic block device support) and `BlockDeviceHotplugSupport` (block device hotplug) which ensures the VMM provides the expected caps. In CoCo scenarios, due to the potential risks of sensitive data leaks or side-channel attacks introduced by virtio-fs through shared file systems, the `FsSharingSupport` flag must be forcibly disabled. This disables the virtio-fs feature at the capability set level, blocking insecure data channels. Fixes kata-containers#11341 Signed-off-by: alex.lyn <alex.lyn@antgroup.com>
Fixes #11341
Signed-off-by: alex.lyn alex.lyn@antgroup.com