kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: prefer /dev/userfaultfd over the syscall

Browse Source 
Prefer /dev/userfaultfd (Linux 6.1+) over the userfaultfd(2) syscall
for obtaining userfaultfd file descriptors.  The device path bypasses
the capable(CAP_SYS_PTRACE) and vm.unprivileged_userfaultfd sysctl
checks that block the syscall in user-namespaced containers, using
file permissions instead.

Falls back to the syscall on older kernels or when the device node
does not exist.

Signed-off-by: Roberto Campesato <render@metalabs.org>
Assisted-by: Claude:claude-opus-4-6
This commit is contained in:
Roberto Campesato
2026-05-07 08:46:20 -07:00
committed by Rob Bradford
parent df1809c1fa
commit fff674a27d
3 changed files with 54 additions and 9 deletions
Download Patch File Download Diff File Expand all files Collapse all files
vmm/src/userfaultfd.rs
+5
View File
@@ -26,6 +26,11 @@ const _: () = assert!(UFFDIO_REGISTER <= u32::MAX as u64);
const _: () = assert!(UFFDIO_COPY <= u32::MAX as u64);
const _: () = assert!(UFFDIO_WAKE <= u32::MAX as u64);
// /dev/userfaultfd ioctl: _IO(0xAA, 0x00)
pub const USERFAULTFD_IOC_NEW: u64 = 0x0000_AA00;
const _: () = assert!(USERFAULTFD_IOC_NEW == ioctl_ioc(0, 0xAA, 0x00, 0));
const _: () = assert!(USERFAULTFD_IOC_NEW <= u32::MAX as u64);
pub const UFFD_API: u64 = 0xAA;
pub const UFFDIO_REGISTER_MODE_MISSING: u64 = 1;
pub const UFFD_EVENT_PAGEFAULT: u8 = 0x12;