| commit | 8e1d4ef231d8327be219f7aea7aa15d181375bbc | |
| author | Stefan Hajnoczi <stefanha@redhat.com> | |
| Wed, 16 Oct 2019 16:01:57 +0000 (16 17:01 +0100) | ||
| committer | Dr. David Alan Gilbert <dgilbert@redhat.com> | |
| Thu, 23 Jan 2020 16:41:37 +0000 (23 16:41 +0000) | ||
| tree | 3361c5f2094568140579a7941fccbd78468edaf0 | treesnapshot (tar.gz zip) |
| parent | d74830d12ae233186ff74ddf64c552d26bb39e50 | commitdiff |
virtiofsd: move to a new pid namespace
virtiofsd needs access to /proc/self/fd. Let's move to a new pid
namespace so that a compromised process cannot see another other
processes running on the system.
One wrinkle in this approach: unshare(CLONE_NEWPID) affects *child*
processes and not the current process. Therefore we need to fork the
pid 1 process that will actually run virtiofsd and leave a parent in
waitpid(2). This is not the same thing as daemonization and parent
processes should not notice a difference.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
virtiofsd needs access to /proc/self/fd. Let's move to a new pid
namespace so that a compromised process cannot see another other
processes running on the system.
One wrinkle in this approach: unshare(CLONE_NEWPID) affects *child*
processes and not the current process. Therefore we need to fork the
pid 1 process that will actually run virtiofsd and leave a parent in
waitpid(2). This is not the same thing as daemonization and parent
processes should not notice a difference.
Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
| tools/virtiofsd/passthrough_ll.c | diffblobblamehistory |