With landlock enabled, the vmdk disk path representing the
descriptor file is added to allowed path. However, this is a
plain text file which points to actual data blobs called extents.
The extent paths are not allowed and must be explicitly passed via
landlock-rules path.
Signed-off-by: Sumedh Alok Sharma <sumsharma@microsoft.com>
Minor modifications were made to make the sentences sound more natural.
Also fixed some parameter usage issues in bash code block.
Signed-off-by: Yi Wang <foxywang@tencent.com>
This requires stashing the config values in `struct Vmm`. The configs
should be validated before before creating the VMM thread. Refactor the
code and update documentation where necessary.
The place where the rules are applied remain the same.
Signed-off-by: Wei Liu <liuwe@microsoft.com>
