kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: make landlock configs VMM-level config

Browse Source 
This requires stashing the config values in `struct Vmm`. The configs
should be validated before before creating the VMM thread. Refactor the
code and update documentation where necessary.

The place where the rules are applied remain the same.

Signed-off-by: Wei Liu <liuwe@microsoft.com>
This commit is contained in:
Wei Liu
2024-07-02 21:12:03 +00:00
committed by Liu Wei
parent 8452edfcc7
commit 94929889ac
6 changed files with 299 additions and 317 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
docs/landlock.md
View File

@@ -30,10 +30,7 @@ Linux kernel confirms Landlock support with above message in dmesg.
## Implementation Details
To enable Landlock, Cloud-Hypervisor process needs the full list of files it
needs to access over its lifetime. Most of these files are received as VM
Configuration (`struct VmConfig`). Landlock is enabled in `vm_create` stage, as
this is the earliest stage in guest boot sequence which has access to guest's
VM Configuration.
needs to access over its lifetime. Landlock is enabled in the `vm_create` stage.
## Enable Landlock