[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [PATCH 049/104] virtiofsd: move to a new pid namespace
From: |
Daniel P . Berrangé |
Subject: |
Re: [PATCH 049/104] virtiofsd: move to a new pid namespace |
Date: |
Mon, 6 Jan 2020 14:40:21 +0000 |
User-agent: |
Mutt/1.12.1 (2019-06-15) |
On Thu, Dec 12, 2019 at 04:38:09PM +0000, Dr. David Alan Gilbert (git) wrote:
> From: Stefan Hajnoczi <address@hidden>
>
> virtiofsd needs access to /proc/self/fd. Let's move to a new pid
> namespace so that a compromised process cannot see another other
> processes running on the system.
>
> One wrinkle in this approach: unshare(CLONE_NEWPID) affects *child*
> processes and not the current process. Therefore we need to fork the
> pid 1 process that will actually run virtiofsd and leave a parent in
> waitpid(2). This is not the same thing as daemonization and parent
> processes should not notice a difference.
>
> Signed-off-by: Stefan Hajnoczi <address@hidden>
> ---
> tools/virtiofsd/passthrough_ll.c | 134 ++++++++++++++++++++-----------
> 1 file changed, 86 insertions(+), 48 deletions(-)
Reviewed-by: Daniel P. Berrangé <address@hidden>
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
[Prev in Thread] |
Current Thread |
[Next in Thread] |
- Re: [PATCH 049/104] virtiofsd: move to a new pid namespace,
Daniel P . Berrangé <=