vmm: Follow the "exe" symlink from the PID directory in /proc

It is necessary to do this at the start of the VMM execution rather than
later as it must be done in the main thread in order to satisfy the
checks required by PTRACE_MODE_READ_FSCREDS (see proc(5) and
ptrace(2))

The alternative is to run as CAP_SYS_PTRACE but that has its
disadvantages.

Signed-off-by: Rob Bradford <robert.bradford@intel.com>
This commit is contained in:
Rob Bradford
2020-02-14 09:55:19 +00:00
parent 503887843f
commit b04eb4770b
3 changed files with 30 additions and 4 deletions
+6
View File
@@ -35,6 +35,7 @@ use std::collections::HashMap;
use std::fs::{File, OpenOptions};
use std::io::{self, sink, stdout};
use std::os::unix::fs::OpenOptionsExt;
use std::path::PathBuf;
use std::result;
#[cfg(feature = "pci_support")]
use std::sync::Weak;
@@ -399,6 +400,9 @@ pub struct DeviceManager {
// The virtio devices on the system
virtio_devices: Vec<(VirtioDeviceArc, bool)>,
// The path to the VMM for self spawning
_vmm_path: PathBuf,
}
impl DeviceManager {
@@ -409,6 +413,7 @@ impl DeviceManager {
memory_manager: Arc<Mutex<MemoryManager>>,
_exit_evt: &EventFd,
reset_evt: &EventFd,
_vmm_path: PathBuf,
) -> DeviceManagerResult<Self> {
let io_bus = devices::Bus::new();
let mmio_bus = devices::Bus::new();
@@ -482,6 +487,7 @@ impl DeviceManager {
migratable_devices,
memory_manager,
virtio_devices: Vec::new(),
_vmm_path,
};
device_manager