From: George Dunlap <george.dunlap@citrix.com>
To: Paul Durrant <Paul.Durrant@citrix.com>,
"xen-devel@lists.xenproject.org" <xen-devel@lists.xenproject.org>
Cc: Anthony Perard <anthony.perard@citrix.com>,
Ian Jackson <Ian.Jackson@citrix.com>,
Wei Liu <wei.liu2@citrix.com>
Subject: Re: [PATCH v2 3/6] tools/dm_restrict: Ask QEMU to chroot
Date: Mon, 24 Sep 2018 10:50:17 +0100 [thread overview]
Message-ID: <9fbed20d-2c1a-a7da-53c8-4c23eec00aeb@citrix.com> (raw)
In-Reply-To: <c5d71bd4789c4ea2880270b917c1bc64@AMSPEX02CL03.citrite.net>
On 09/24/2018 09:20 AM, Paul Durrant wrote:
>> -----Original Message-----
>> From: Xen-devel [mailto:xen-devel-bounces@lists.xenproject.org] On Behalf
>> Of George Dunlap
>> Sent: 21 September 2018 18:04
>> To: xen-devel@lists.xenproject.org
>> Cc: Anthony Perard <anthony.perard@citrix.com>; Ian Jackson
>> <Ian.Jackson@citrix.com>; Wei Liu <wei.liu2@citrix.com>; George Dunlap
>> <George.Dunlap@citrix.com>
>> Subject: [Xen-devel] [PATCH v2 3/6] tools/dm_restrict: Ask QEMU to chroot
>>
>> When dm_restrict is enabled, ask QEMU to chroot into an empty directory.
>>
>> * Create /var/run/qemu/root-domid (deleting the old one if it's there)
>> * Pass the -chroot option to QEMU
>>
>> Rather than running `rm -rf` on the directory before creating it
>> (since there is no library function to do this), simply rmdir the
>> directory, relying on the fact that the previous QEMU instance, if
>> properly restcirted, shouldn't have been able to write anything
>
> ^ typo... 'restricted'
Oops -- fixed, thanks.
>> diff --git a/docs/designs/qemu-deprivilege.md b/docs/designs/qemu-
>> deprivilege.md
>> index 1e731c16aa..df5bb07d7c 100644
>> --- a/docs/designs/qemu-deprivilege.md
>> +++ b/docs/designs/qemu-deprivilege.md
>> @@ -58,12 +58,6 @@ FIXME: Double-check the correctness of the above
>>
>> '''Testing status''': Tested
>>
>> -# Restrictions / improvements still to do
>> -
>> -This lists potential restrictions still to do. It is meant to be
>> -listed in order of ease of implementation, with low-hanging fruit
>> -first.
>> -
>> ## Chroot
>>
>> '''Description''': Qemu runs in its own chroot, such that even if it
>> @@ -81,6 +75,12 @@ Then adds the following to the qemu command-line:
>>
>> '''Tested''': Not tested
>
> ^ should this change to 'tested' now?
I sort of went back and forth here between whether this should mean 'a
test it available' (i.e., depriv-process-checker.sh checks it) and 'this
is actively being tested' (i.e., by osstest). Here I ended up going
with the second option, but that makes a weird dependency between
xen.git and osstest.
One option, I suppose, would be to change this to "Test implemented" or
something.
-George
_______________________________________________
Xen-devel mailing list
Xen-devel@lists.xenproject.org
https://lists.xenproject.org/mailman/listinfo/xen-devel
next prev parent reply other threads:[~2018-09-24 9:50 UTC|newest]
Thread overview: 39+ messages / expand[flat|nested] mbox.gz Atom feed top
2018-09-21 17:04 [PATCH v2 1/6] docs/qemu-deprivilege: Revise and update with status and future plans George Dunlap
2018-09-21 17:04 ` [PATCH v2 2/6] test/depriv: Add a tool to check process-level depriv George Dunlap
2018-09-24 10:57 ` Ian Jackson
2018-09-24 14:45 ` George Dunlap
2018-09-24 11:14 ` Anthony PERARD
2018-09-21 17:04 ` [PATCH v2 3/6] tools/dm_restrict: Ask QEMU to chroot George Dunlap
2018-09-24 8:20 ` Paul Durrant
2018-09-24 9:50 ` George Dunlap [this message]
2018-09-24 9:52 ` Paul Durrant
2018-09-24 10:31 ` Ian Jackson
2018-09-21 17:04 ` [PATCH v2 4/6] tools/dm_restrict: Unshare mount and IPC namespaces on Linux George Dunlap
2018-09-24 8:24 ` Paul Durrant
2018-09-24 10:40 ` Ian Jackson
2018-09-24 14:22 ` George Dunlap
2018-09-25 10:55 ` Ian Jackson
2018-09-21 17:04 ` [PATCH v2 5/6] tools/dm_depriv: Add first cut RLIMITs George Dunlap
2018-09-24 8:34 ` Paul Durrant
[not found] ` <CAFLBxZanne777R0WfJLuGqTv3dx=A+W0Z5UsW9B0i4MFMWWKXw@mail.gmail.com>
2018-10-05 15:18 ` George Dunlap
2018-09-24 10:48 ` Ian Jackson
2018-09-24 14:41 ` George Dunlap
2018-09-25 11:03 ` Ian Jackson
2018-09-21 17:04 ` [PATCH v2 6/6] RFC: tools/dm_restrict: Enable QEMU sandboxing George Dunlap
2018-09-24 10:49 ` Ian Jackson
2018-09-24 11:16 ` George Dunlap
2018-09-24 13:04 ` Ian Jackson
2018-09-24 13:43 ` George Dunlap
2018-09-25 10:46 ` Ian Jackson
2018-09-24 11:21 ` Ian Jackson
2018-09-24 14:28 ` George Dunlap
2018-09-25 11:02 ` Ian Jackson
2018-09-25 14:24 ` George Dunlap
2018-09-26 10:57 ` Ian Jackson
2018-09-24 8:14 ` [PATCH v2 1/6] docs/qemu-deprivilege: Revise and update with status and future plans Paul Durrant
2018-09-24 10:23 ` Ian Jackson
2018-09-24 13:08 ` George Dunlap
2018-09-25 10:44 ` Ian Jackson
2018-09-25 11:20 ` Anthony PERARD
2018-09-28 11:37 ` George Dunlap
2018-09-28 12:59 ` Anthony PERARD
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=9fbed20d-2c1a-a7da-53c8-4c23eec00aeb@citrix.com \
--to=george.dunlap@citrix.com \
--cc=Ian.Jackson@citrix.com \
--cc=Paul.Durrant@citrix.com \
--cc=anthony.perard@citrix.com \
--cc=wei.liu2@citrix.com \
--cc=xen-devel@lists.xenproject.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.