OpenE2K/qemu-e2k
13
4
Fork 0
Code Issues 4 Pull Requests Projects 2 Releases Activity

virtiofsd: move to an empty network namespace

Browse Source 
If the process is compromised there should be no network access.  Use an
empty network namespace to sandbox networking.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Stefan Hajnoczi 2019-10-16 17:01:56 +01:00 committed by Dr. David Alan Gilbert
parent 5baa3b8e95
commit d74830d12a
1 changed files with 14 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
tools/virtiofsd/passthrough_ll.c
View File

@ -1944,6 +1944,19 @@ static void print_capabilities(void)
printf("}\n");
}
/*
* Called after our UNIX domain sockets have been created, now we can move to
* an empty network namespace to prevent TCP/IP and other network activity in
* case this process is compromised.
*/
static void setup_net_namespace(void)
{
if (unshare(CLONE_NEWNET) != 0) {
fuse_log(FUSE_LOG_ERR, "unshare(CLONE_NEWNET): %m\n");
exit(1);
}
}
/* This magic is based on lxc's lxc_pivot_root() */
static void setup_pivot_root(const char *source)
{
@ -2035,6 +2048,7 @@ static void setup_mount_namespace(const char *source)
*/
static void setup_sandbox(struct lo_data *lo)
{
setup_net_namespace();
setup_mount_namespace(lo->source);
}