motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-03 07:43:54 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

virtiofsd: move to an empty network namespace

Browse source 
If the process is compromised there should be no network access.  Use an
empty network namespace to sandbox networking.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Stefan Hajnoczi 2019-10-16 17:01:56 +01:00 • committed by Dr. David Alan Gilbert
parent 5baa3b8e95
commit d74830d12a
1 changed files with 14 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

14
tools/virtiofsd/passthrough_ll.c
View file

@ -1944,6 +1944,19 @@ static void print_capabilities(void)
printf("}\n"); printf("}\n");
} }
/*
* Called after our UNIX domain sockets have been created, now we can move to
* an empty network namespace to prevent TCP/IP and other network activity in
* case this process is compromised.
*/
static void setup_net_namespace(void)
{
if (unshare(CLONE_NEWNET) != 0) {
fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWNET): %m\n");
exit(1);
}
}
/* This magic is based on lxc's lxc_pivot_root() */ /* This magic is based on lxc's lxc_pivot_root() */
static void setup_pivot_root(const char *source) static void setup_pivot_root(const char *source)
{ {
@ -2035,6 +2048,7 @@ static void setup_mount_namespace(const char *source)
*/ */
static void setup_sandbox(struct lo_data *lo) static void setup_sandbox(struct lo_data *lo)
{ {
setup_net_namespace();
setup_mount_namespace(lo->source); setup_mount_namespace(lo->source);
} }