mirrors/qemu
0
0
Fork 0
mirror of https://github.com/qemu/qemu.git synced 2025-01-19 12:03:51 +08:00
Code Issues Packages Projects Releases Wiki Activity

virtiofsd: drop all capabilities in the wait parent process

Browse Source 
All this process does is wait for its child.  No capabilities are
needed.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
This commit is contained in:
Stefan Hajnoczi 2020-04-16 17:49:07 +01:00 committed by Dr. David Alan Gilbert
parent a59feb483b
commit 66502bbca3
1 changed files with 13 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

13
tools/virtiofsd/passthrough_ll.c
View File

@ -2530,6 +2530,17 @@ static void print_capabilities(void)
printf("}\n"); printf("}\n");
} }
/*
* Drop all Linux capabilities because the wait parent process only needs to
* sit in waitpid(2) and terminate.
*/
static void setup_wait_parent_capabilities(void)
{
capng_setpid(syscall(SYS_gettid));
capng_clear(CAPNG_SELECT_BOTH);
capng_apply(CAPNG_SELECT_BOTH);
}
/* /*
* Move to a new mount, net, and pid namespaces to isolate this process. * Move to a new mount, net, and pid namespaces to isolate this process.
*/ */
@ -2563,6 +2574,8 @@ static void setup_namespaces(struct lo_data *lo, struct fuse_session *se)
pid_t waited; pid_t waited;
int wstatus; int wstatus;
setup_wait_parent_capabilities();
/* The parent waits for the child */ /* The parent waits for the child */
do { do {
waited = waitpid(child, &wstatus, 0); waited = waitpid(child, &wstatus, 0);