qemu: pass guest image file readonly

So that we fobid guest from making changes to it.

Fixes: #2476
Signed-off-by: Peng Tao <bergwolf@hyper.sh>

virtcontainers/device/config/config.go

@@ -153,6 +153,9 @@ type BlockDrive struct {
 
 	// ShareRW enables multiple qemu instances to share the File
 	ShareRW bool
+
+	// ReadOnly sets the device file readonly
+	ReadOnly bool
 }
 
 // VFIODeviceType indicates VFIO device type

virtcontainers/qemu_arch_base.go

@@ -343,10 +343,11 @@ func genericImage(path string) (config.BlockDrive, error) {
 	id := utils.MakeNameID("image", hex.EncodeToString(randBytes), maxDevIDSize)
 
 	drive := config.BlockDrive{
-		File:    path,
-		Format:  "raw",
-		ID:      id,
-		ShareRW: true,
+		File:     path,
+		Format:   "raw",
+		ID:       id,
+		ShareRW:  true,
+		ReadOnly: true,
 	}
 
 	return drive, nil
@@ -603,6 +604,7 @@ func genericBlockDevice(drive config.BlockDrive, nestedRun bool) (govmmQemu.Bloc
 		Interface:     "none",
 		DisableModern: nestedRun,
 		ShareRW:       drive.ShareRW,
+		ReadOnly:      drive.ReadOnly,
 	}, nil
 }
 

virtcontainers/qemu_arch_base_test.go

@@ -308,6 +308,7 @@ func TestQemuArchBaseAppendImage(t *testing.T) {
 			Format:    "raw",
 			Interface: "none",
 			ShareRW:   true,
+			ReadOnly:  true,
 		},
 	}