kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: tighten landlock rule for PmemConfig

Browse Source 
when discard_writes is true, only grant read access in landlock

Signed-off-by: Andrew Consroe <aconz2@gmail.com>
This commit is contained in:
Andrew Consroe
2025-03-18 16:16:04 -05:00
committed by Wei Liu
parent 5aa1540c5d
commit a38b4c7f17
1 changed files with 2 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
vmm/src/vm_config.rs
View File

@@ -486,7 +486,8 @@ pub struct PmemConfig {
impl ApplyLandlock for PmemConfig { impl ApplyLandlock for PmemConfig {
fn apply_landlock(&self, landlock: &mut Landlock) -> LandlockResult<()> { fn apply_landlock(&self, landlock: &mut Landlock) -> LandlockResult<()> {
landlock.add_rule_with_access(self.file.to_path_buf(), "rw")?; let access = if self.discard_writes { "r" } else { "rw" };
landlock.add_rule_with_access(self.file.to_path_buf(), access)?;
Ok(()) Ok(())
} }
} }