[-V4,4/7] virtio-9p: Implement Security model for mknod related files

diff --git a/hw/file-op-9p.h b/hw/file-op-9p.h
index 73d59b2..144dd77 100644
--- a/hw/file-op-9p.h
+++ b/hw/file-op-9p.h
@@ -51,8 +51,7 @@  typedef struct FileOperations
     ssize_t (*readlink)(FsContext *, const char *, char *, size_t);
     int (*chmod)(FsContext *, const char *, mode_t);
     int (*chown)(FsContext *, const char *, uid_t, gid_t);
-    int (*mknod)(FsContext *, const char *, mode_t, dev_t);
-    int (*mksock)(FsContext *, const char *);
+    int (*mknod)(FsContext *, const char *, FsCred *);
     int (*utime)(FsContext *, const char *, const struct utimbuf *);
     int (*remove)(FsContext *, const char *);
     int (*symlink)(FsContext *, const char *, const char *);
diff --git a/hw/virtio-9p-local.c b/hw/virtio-9p-local.c
index f6c2fe2..bd8c1c7 100644
--- a/hw/virtio-9p-local.c
+++ b/hw/virtio-9p-local.c
@@ -134,33 +134,44 @@  static int local_chmod(FsContext *ctx, const char *path, mode_t mode)
     return chmod(rpath(ctx, path), mode);
 }
 
-static int local_mknod(FsContext *ctx, const char *path, mode_t mode, dev_t dev)
+static int local_mknod(FsContext *fs_ctx, const char *path, FsCred *credp)
 {
-    return mknod(rpath(ctx, path), mode, dev);
-}
-
-static int local_mksock(FsContext *ctx2, const char *path)
-{
-    struct sockaddr_un addr;
-    int s;
-
-    addr.sun_family = AF_UNIX;
-    snprintf(addr.sun_path, 108, "%s", rpath(ctx2, path));
-
-    s = socket(PF_UNIX, SOCK_STREAM, 0);
-    if (s == -1) {
-        return -1;
-    }
-
-    if (bind(s, (struct sockaddr *)&addr, sizeof(addr))) {
-        close(s);
-        return -1;
+    int err = -1;
+    int serrno = 0;
+    /* Determine the security model */
+    if (fs_ctx->fs_sm == SM_MAPPED) {
+        err = mknod(rpath(fs_ctx, path), SM_LOCAL_MODE_BITS|S_IFREG, 0);
+        if (err == -1) {
+            return err;
+        }
+        local_set_xattr(rpath(fs_ctx, path), credp);
+        if (err == -1) {
+            serrno = errno;
+            goto err_end;
+        }
+    } else if (fs_ctx->fs_sm == SM_PASSTHROUGH) {
+        err = mknod(rpath(fs_ctx, path), credp->fc_mode, credp->fc_rdev);
+        if (err == -1) {
+            return err;
+        }
+        err = chmod(rpath(fs_ctx, path), credp->fc_mode & 07777);
+        if (err == -1) {
+            serrno = errno;
+            goto err_end;
+        }
+        err = chown(rpath(fs_ctx, path), credp->fc_uid, credp->fc_gid);
+        if (err == -1) {
+            serrno = errno;
+            goto err_end;
+        }
     }
+    return err;
 
-    close(s);
-    return 0;
+err_end:
+    remove(rpath(fs_ctx, path));
+    errno = serrno;
+    return err;
 }
-
 static int local_mkdir(FsContext *fs_ctx, const char *path, FsCred *credp)
 {
     int err = -1;
@@ -351,7 +362,6 @@  FileOperations local_ops = {
     .writev = local_writev,
     .chmod = local_chmod,
     .mknod = local_mknod,
-    .mksock = local_mksock,
     .mkdir = local_mkdir,
     .fstat = local_fstat,
     .open2 = local_open2,
diff --git a/hw/virtio-9p.c b/hw/virtio-9p.c
index ef870a3..38c1d68 100644
--- a/hw/virtio-9p.c
+++ b/hw/virtio-9p.c
@@ -157,14 +157,15 @@  static int v9fs_do_chmod(V9fsState *s, V9fsString *path, mode_t mode)
     return s->ops->chmod(&s->ctx, path->data, mode);
 }
 
-static int v9fs_do_mknod(V9fsState *s, V9fsString *path, mode_t mode, dev_t dev)
+static int v9fs_do_mknod(V9fsState *s, V9fsCreateState *vs, mode_t mode,
+        dev_t dev)
 {
-    return s->ops->mknod(&s->ctx, path->data, mode, dev);
-}
-
-static int v9fs_do_mksock(V9fsState *s, V9fsString *path)
-{
-    return s->ops->mksock(&s->ctx, path->data);
+    FsCred cred;
+    cred_init(&cred);
+    cred.fc_uid = vs->fidp->uid;
+    cred.fc_mode = mode;
+    cred.fc_rdev = dev;
+    return s->ops->mknod(&s->ctx, vs->fullname.data, &cred);
 }
 
 static int v9fs_do_mkdir(V9fsState *s, V9fsCreateState *vs)
@@ -1725,22 +1726,6 @@  out:
     v9fs_post_create(s, vs, err);
 }
 
-static void v9fs_create_post_mksock(V9fsState *s, V9fsCreateState *vs,
-                                                                int err)
-{
-    if (err) {
-        err = -errno;
-        goto out;
-    }
-
-    err = v9fs_do_chmod(s, &vs->fullname, vs->perm & 0777);
-    v9fs_create_post_perms(s, vs, err);
-    return;
-
-out:
-    v9fs_post_create(s, vs, err);
-}
-
 static void v9fs_create_post_fstat(V9fsState *s, V9fsCreateState *vs, int err)
 {
     if (err) {
@@ -1816,14 +1801,14 @@  static void v9fs_create_post_lstat(V9fsState *s, V9fsCreateState *vs, int err)
         }
 
         nmode |= vs->perm & 0777;
-        err = v9fs_do_mknod(s, &vs->fullname, nmode, makedev(major, minor));
+        err = v9fs_do_mknod(s, vs, nmode, makedev(major, minor));
         v9fs_create_post_perms(s, vs, err);
     } else if (vs->perm & P9_STAT_MODE_NAMED_PIPE) {
-        err = v9fs_do_mknod(s, &vs->fullname, S_IFIFO | (vs->mode & 0777), 0);
+        err = v9fs_do_mknod(s, vs, S_IFIFO | (vs->perm & 0777), 0);
         v9fs_post_create(s, vs, err);
     } else if (vs->perm & P9_STAT_MODE_SOCKET) {
-        err = v9fs_do_mksock(s, &vs->fullname);
-        v9fs_create_post_mksock(s, vs, err);
+        err = v9fs_do_mknod(s, vs, S_IFSOCK | (vs->perm & 0777), 0);
+        v9fs_post_create(s, vs, err);
     } else {
         vs->fidp->fd = v9fs_do_open2(s, vs);
         v9fs_create_post_open2(s, vs, err);