diff options
author | Stefan Hajnoczi <stefanha@redhat.com> | 2020-10-08 09:55:34 +0100 |
---|---|---|
committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | 2020-10-26 18:35:32 +0000 |
commit | 06844584b62a43384642f7243b0fc01c9fff0fc7 (patch) | |
tree | 969594181ec3954c7ea04dad346117c077ada794 /block/blkdebug.c | |
parent | 800ad114f10d0bf94e49b1441e1a13064a45a967 (diff) | |
download | qemu-06844584b62a43384642f7243b0fc01c9fff0fc7.zip qemu-06844584b62a43384642f7243b0fc01c9fff0fc7.tar.gz qemu-06844584b62a43384642f7243b0fc01c9fff0fc7.tar.bz2 |
virtiofsd: add container-friendly -o sandbox=chroot option
virtiofsd cannot run in a container because CAP_SYS_ADMIN is required to
create namespaces.
Introduce a weaker sandbox mode that is sufficient in container
environments because the container runtime already sets up namespaces.
Use chroot to restrict path traversal to the shared directory.
virtiofsd loses the following:
1. Mount namespace. The process chroots to the shared directory but
leaves the mounts in place. Seccomp rejects mount(2)/umount(2)
syscalls.
2. Pid namespace. This should be fine because virtiofsd is the only
process running in the container.
3. Network namespace. This should be fine because seccomp already
rejects the connect(2) syscall, but an additional layer of security
is lost. Container runtime-specific network security policies can be
used drop network traffic (except for the vhost-user UNIX domain
socket).
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Message-Id: <20201008085534.16070-1-stefanha@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Diffstat (limited to 'block/blkdebug.c')
0 files changed, 0 insertions, 0 deletions