Miklos Szeredi 397ae982f4 virtiofsd: jail lo->proc_self_fd ... While it's not possible to escape the proc filesystem through lo->proc_self_fd, it is possible to escape to the root of the proc filesystem itself through "../..". Use a temporary mount for opening lo->proc_self_fd, that has it's root at /proc/self/fd/, preventing access to the ancestor directories. Signed-off-by: Miklos Szeredi <mszeredi@redhat.com> Message-Id: <20200429124733.22488-1-mszeredi@redhat.com> Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com> Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>		2020-05-01 18:46:54 +01:00
..
virtiofsd	virtiofsd: jail lo->proc_self_fd	2020-05-01 18:46:54 +01:00