diff options
author | Chirantan Ekbote <chirantan@chromium.org> | 2018-11-16 11:39:02 -0800 |
---|---|---|
committer | chrome-bot <chrome-bot@chromium.org> | 2019-01-07 19:40:14 -0800 |
commit | 1502a11ed0a1844a4465eb55d6a06cba3405ffcd (patch) | |
tree | f9365d8d4805b840a43bfdc0de668de533883513 /src/plugin/mod.rs | |
parent | 2d292331df330b15365d0d2909b9fcaf8fca97ce (diff) | |
download | crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.tar crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.tar.gz crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.tar.bz2 crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.tar.lz crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.tar.xz crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.tar.zst crosvm-1502a11ed0a1844a4465eb55d6a06cba3405ffcd.zip |
plugin: Fix tmpfs mount options
Mounting a filesystem with the `exec` flag has required CAP_SYS_ADMIN in the init namespace since February 2018. BUG=b:80150167 TEST=run the plugin_adder test plugin Change-Id: Ibf3fdf52314d15f0154742e1b6c11f73155d2d59 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1341102 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
Diffstat (limited to 'src/plugin/mod.rs')
-rw-r--r-- | src/plugin/mod.rs | 4 |
1 files changed, 2 insertions, 2 deletions
diff --git a/src/plugin/mod.rs b/src/plugin/mod.rs index 0aa2ff4..d594a9a 100644 --- a/src/plugin/mod.rs +++ b/src/plugin/mod.rs @@ -19,7 +19,7 @@ use std::time::{Duration, Instant}; use libc::{ c_ulong, ioctl, socketpair, AF_UNIX, EAGAIN, EBADF, EDEADLK, EEXIST, EINTR, EINVAL, ENOENT, - EOVERFLOW, EPERM, FIOCLEX, MS_NODEV, MS_NOSUID, SIGCHLD, SOCK_SEQPACKET, + EOVERFLOW, EPERM, FIOCLEX, MS_NODEV, MS_NOEXEC, MS_NOSUID, SIGCHLD, SOCK_SEQPACKET, }; use protobuf::ProtobufError; @@ -252,7 +252,7 @@ fn create_plugin_jail(root: &Path, seccomp_policy: &Path) -> Result<Minijail> { Path::new("none"), Path::new("/"), "tmpfs", - (MS_NOSUID | MS_NODEV) as usize, + (MS_NOSUID | MS_NODEV | MS_NOEXEC) as usize, "size=67108864", ) .map_err(Error::MountRoot)?; |