projects / qemu.git / commit
? search:
summary | shortlog | log | commit | commitdiff | tree
(parent: 9f59d17) | patch
virtiofsd: sandbox mount namespace
authorStefan Hajnoczi <stefanha@redhat.com>
Tue, 12 Mar 2019 15:51:38 +0000 (15:51 +0000)
committerDr. David Alan Gilbert <dgilbert@redhat.com>
Thu, 23 Jan 2020 16:41:36 +0000 (16:41 +0000)
commit5baa3b8e95064c2434bd9e2f312edd5e9ae275dc
tree4ee8509f3cbef95d26b0aea4c8d3131f8b28a09btree | snapshot
parent9f59d175e2ca96f0b87f534dba69ea547dd35945commit | diff
virtiofsd: sandbox mount namespace

Use a mount namespace with the shared directory tree mounted at "/" and
no other mounts.

This prevents symlink escape attacks because symlink targets are
resolved only against the shared directory and cannot go outside it.

Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Peng Tao <tao.peng@linux.alibaba.com>
Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>
Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
tools/virtiofsd/passthrough_ll.c diff | blob | history
Unnamed repository; edit this file 'description' to name the repository.