Stefan Hajnoczi a59feb483b virtiofsd: only retain file system capabilities ... virtiofsd runs as root but only needs a subset of root's Linux capabilities(7). As a file server its purpose is to create and access files on behalf of a client. It needs to be able to access files with arbitrary uid/gid owners. It also needs to be create device nodes. Introduce a Linux capabilities(7) whitelist and drop all capabilities that we don't need, making the virtiofsd process less powerful than a regular uid root process. # cat /proc/PID/status ... Before After CapInh: 0000000000000000 0000000000000000 CapPrm: 0000003fffffffff 00000000880000df CapEff: 0000003fffffffff 00000000880000df CapBnd: 0000003fffffffff 0000000000000000 CapAmb: 0000000000000000 0000000000000000 Note that file capabilities cannot be used to achieve the same effect on the virtiofsd executable because mount is used during sandbox setup. Therefore we drop capabilities programmatically at the right point during startup. This patch only affects the sandboxed child process. The parent process that sits in waitpid(2) still has full root capabilities and will be addressed in the next patch. Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com> Message-Id: <20200416164907.244868-2-stefanha@redhat.com> Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>		2020-05-01 18:57:31 +01:00
..
50-qemu-virtiofsd.json.in	virtiofsd: add vhost-user.json file	2020-01-23 16:41:36 +00:00
buffer.c	virtiofsd: use fuse_buf_writev to replace fuse_buf_write for better performance	2020-01-23 16:41:37 +00:00
fuse_common.h	virtiofsd: Parse flag FUSE_WRITE_KILL_PRIV	2020-01-23 16:41:37 +00:00
fuse_i.h	virtiofsd: Remove fuse.h and struct fuse_module	2020-02-21 12:53:17 +00:00
fuse_log.c	virtiofsd: Fix common header and define for QEMU builds	2020-01-23 16:41:36 +00:00
fuse_log.h	virtiofsd: Format imported files to qemu style	2020-01-23 16:41:36 +00:00
fuse_lowlevel.c	tools/virtiofsd/fuse_lowlevel: Fix fuse_out_header::error value	2020-02-21 12:53:17 +00:00
fuse_lowlevel.h	virtiofsd: add --rlimit-nofile=NUM option	2020-05-01 18:41:55 +01:00
fuse_misc.h	virtiofsd: support nanosecond resolution for file timestamp	2020-01-23 16:41:37 +00:00
fuse_opt.c	virtiofsd: Fix common header and define for QEMU builds	2020-01-23 16:41:36 +00:00
fuse_opt.h	virtiofsd: Format imported files to qemu style	2020-01-23 16:41:36 +00:00
fuse_signals.c	virtiofsd: convert more fprintf and perror to use fuse log infra	2020-01-23 16:41:37 +00:00
fuse_virtio.c	virtiofsd: Fix xattr operations	2020-03-03 15:13:24 +00:00
fuse_virtio.h	virtiofsd: cleanup allocated resource in se	2020-01-23 16:41:37 +00:00
helper.c	virtiofsd: stay below fs.file-max sysctl value (CVE-2020-10717)	2020-05-01 18:41:56 +01:00
Makefile.objs	virtiofsd: add seccomp whitelist	2020-01-23 16:41:37 +00:00
passthrough_helpers.h	virtiofsd: Format imported files to qemu style	2020-01-23 16:41:36 +00:00
passthrough_ll.c	virtiofsd: only retain file system capabilities	2020-05-01 18:57:31 +01:00
seccomp.c	virtiofsd: Fix xattr operations	2020-03-03 15:13:24 +00:00
seccomp.h	virtiofsd: add --syslog command-line option	2020-01-23 16:41:37 +00:00