virtfs,security_model=mapped + symlink = ELOOP

Host environment

• Operating system: Ubuntu 22.04.5
• OS/kernel version: Linux … 6.8.0-60-generic #63~22.04.1-Ubuntu SMP PREEMPT_DYNAMIC Tue Apr 22 19:00:15 UTC 2 x86_64 x86_64 x86_64 GNU/Linux
• Architecture: x86_64
• QEMU flavor: qemu-system-arm
• QEMU version: QEMU emulator version 10.0.94 (built from qemu-10.1.0-rc4.tar.xz)
• QEMU command line:

wget -nc https://downloads.openwrt.org/snapshots/targets/armsr/armv7/openwrt-armsr-armv7-generic-kernel.bin

ROOTRO="./rootro/"
mkdir -p "$ROOTRO/sbin"
touch "$ROOTRO/sbin/real_init"
chmod +x "$ROOTRO/sbin/real_init"
ln -sf real_init "$ROOTRO/sbin/init"

../qemu-10.1.0-rc4/build/qemu-system-arm -M virt -no-reboot -nographic \
	-kernel ./openwrt-armsr-armv7-generic-kernel.bin \
	-append 'root=rootfs rootfstype=9p rootflags=trans=virtio init=/sbin/init' \
	-virtfs local,path="$ROOTRO",security_model=mapped,mount_tag=rootfs,readonly=on

Emulated/Virtualized environment

• Operating system: OpenWRT (kinda)
• OS/kernel version: Linux version 6.12.40 (builder@buildhost) (arm-openwrt-linux-muslgnueabi-gcc (OpenWrt GCC 14.3.0 r30824-db0b0e14be) 14.3.0, GNU ld (GNU Binutils) 2.44) #0 SMP Fri Aug 22 18:18:16 2025
• Architecture: ARMv7

Description of problem

With security_model=mapped-xattr or security_model=mapped-file, attempting to read /sbin/init (which is a symlink) results in ELOOP:

[    0.485371] Kernel panic - not syncing: Requested init /sbin/init failed (error -40).

With security_model=none, we fail with ENOEXEC, as expected (the file is empty)

[    0.522365] Kernel panic - not syncing: Requested init /sbin/init failed (error -8).

Steps to reproduce

1. Run the code above as a script (replace with your path to qemu-system-arm)

Additional information

Same issue with the distro's QEMU emulator version 6.2.0 (Debian 1:6.2+dfsg-2ubuntu6.26)

P.S. fuse-overlayfs was a red herring