mirror of
https://github.com/xen-project/xen.git
synced 2026-10-29 18:50:05 +01:00
George Dunlap
371a23e65d
QEMU running under Xen doesn't need mount or IPC functionality. Create and enter separate namespaces for each of these before executing QEMU, so that in the event that other restrictions fail, the process won't be able to even name system mount points or exsting non-file-based IPC descriptors to attempt to attack them. Unsharing is something a process can only do to itself (it would seem); so add an os-specific "dm_preexec_restrict()" hook just before we exec() the device model. Also add checks to depriv-process-checker.sh to verify that dm is running in a new namespace (or at least, a different one than the caller). Suggested-by: Ross Lagerwall <ross.lagerwall@citrix.com> Signed-off-by: George Dunlap <george.dunlap@citrix.com> Acked-by: Ian Jackson <ian.jackson@eu.citrix.com> --- Changes since v4: - Fix function prototype for netbsd code Changes since v3: - Fix some more style issues Changes since v2: - Return an error rather than calling exit() - Use LOGE() and print to the current stderr fd, rather than printing to the new stderr fd via write() - Use r for external return values rather than rc. CC: Ian Jackson <ian.jackson@citrix.com> CC: Wei Liu <wei.liu2@citrix.com> CC: Anthony Perard <anthony.perard@citrix.com>