[Virtio-fs] [PATCH v2 5/5] virtiofsd: Skip setup_capabilities() in sandbox=NONE mode
Dr. David Alan Gilbert
dgilbert at redhat.com
Fri Aug 7 17:58:39 UTC 2020
* Vivek Goyal (vgoyal at redhat.com) wrote:
> setup_capabilites() tries to give some of the required capabilities
> to act as a full fledged file server in priviliged mode. In unpriviliged
> mode we can't get those capabilities and setup_capabilities() will fail.
>
> So don't setup capabilities when sandbox=NONE.
>
> Signed-off-by: Vivek Goyal <vgoyal at redhat.com>
> ---
> tools/virtiofsd/passthrough_ll.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/tools/virtiofsd/passthrough_ll.c b/tools/virtiofsd/passthrough_ll.c
> index a6fa816b6c..1a0b24cbf2 100644
> --- a/tools/virtiofsd/passthrough_ll.c
> +++ b/tools/virtiofsd/passthrough_ll.c
> @@ -3030,7 +3030,8 @@ static void setup_sandbox(struct lo_data *lo, struct fuse_session *se,
> }
>
> setup_seccomp(enable_syslog);
> - setup_capabilities(g_strdup(lo->modcaps));
> + if (lo->sandbox != SANDBOX_NONE)
> + setup_capabilities(g_strdup(lo->modcaps));
> }
I'd rather keep capabilities and sandboxing separate.
Since I already added modcaps= how about just letting that
take a varient as '-o modcaps=keep'
Dave
> /* Set the maximum number of open file descriptors */
> --
> 2.25.4
>
--
Dr. David Alan Gilbert / dgilbert at redhat.com / Manchester, UK
More information about the Virtio-fs
mailing list