VIRTFS-PROXY-HELPER(1)

💖 VIRTFS-PROXY-HELPER 💖

okay so bestie, welcome to the manual page for virtfs-proxy-helper — it's the QEMU 9p virtfs proxy filesystem helper and honestly? it's giving "tiny daemon, huge responsibilities" 👑

---

✨ SYNOPSIS ✨

virtfs-proxy-helper [OPTIONS]

that's it. that's the whole vibe. options only, no positional args, no drama 🌸

---

🦋 DESCRIPTION 🦋

⚠️ READ THIS FIRST, FR FR: the 9p proxy backend is deprecated (since QEMU 8.1) and will be removed, along with this daemon, in a future version of QEMU. not "maybe", not "we'll see" — removed. 💀

so here's the lore. the pass-through security model in the QEMU 9p server needs root privilege to do a few file operations (like chown, chmod to any mode/uid:gid). and that model has two whole problems:

• TOCTTOU vulnerability: following symbolic links in the server could provide access to files beyond the 9p export path. 😭
• running QEMU with root privilege could be a security issue. 🙈

to overcome the above issues, here's the approach, and it's actually kind of iconic: a new filesystem type proxy is introduced. Proxy FS uses a chroot + socket combination for securing the vulnerability known with following symbolic links. the intention of adding a new filesystem type is to allow qemu to run in non-root mode, while still doing privileged operations using socket IO. 🫶

the Proxy helper (a stand-alone binary, part of qemu) is invoked with root privileges. Proxy helper chroots into the 9p export path and creates a socket pair or a named socket, based on the command line parameter. QEMU and the proxy helper communicate using this socket. the QEMU proxy fs driver sends filesystem requests to the proxy helper and receives the response back from it. ✨

and the best part? the proxy helper is designed so that it can drop root privileges — except for the capabilities needed for doing filesystem operations. main character energy, honestly. 👑

---

🎀 OPTIONS 🎀

the following options are supported:

• -h — display help and exit. short, sweet, slays. 💅
• -p, --path PATH — path to export for the proxy filesystem driver. this is the 9p export path it chroots into, iykyk. 🍓
• -f, --fd SOCKET_ID — use the given file descriptor as the socket descriptor for communicating with the qemu proxy fs driver. usually a helper like libvirt will create a socketpair and pass one of the fds as the parameter to this option. 🔥
• -s, --socket SOCKET_FILE — creates a named socket file for communicating with the qemu proxy fs driver. 🌸
• -u, --uid UID — uid to give access to the named socket file; used in combination with -g. 🧚
• -g, --gid GID — gid to give access to the named socket file; used in combination with -u. 🧚
• -n, --nodaemon — run as a normal program. by default, the program will run in daemon mode. not me being surprised by the daemon default every single time 😭

---

💜 AUTHOR 💜

M. Mohan Kumar

---

🌈 COPYRIGHT 🌈

2026, The QEMU Project Developers

---

and that's the whole page, bestie! 🫶 this one came from the QEMU manual, version 8.2.2, dated Apr 08, 2026 — so if you're reading this, hi from the future, drink water, and go chown responsibly 💖✨🎀