* Vivek Goyal ([email protected]) wrote: > setup_capabilites() tries to give some of the required capabilities > to act as a full fledged file server in priviliged mode. In unpriviliged > mode we can't get those capabilities and setup_capabilities() will fail. > > So don't setup capabilities when sandbox=NONE. > > Signed-off-by: Vivek Goyal <[email protected]> > --- > tools/virtiofsd/passthrough_ll.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/tools/virtiofsd/passthrough_ll.c > b/tools/virtiofsd/passthrough_ll.c > index a6fa816b6c..1a0b24cbf2 100644 > --- a/tools/virtiofsd/passthrough_ll.c > +++ b/tools/virtiofsd/passthrough_ll.c > @@ -3030,7 +3030,8 @@ static void setup_sandbox(struct lo_data *lo, struct > fuse_session *se, > } > > setup_seccomp(enable_syslog); > - setup_capabilities(g_strdup(lo->modcaps)); > + if (lo->sandbox != SANDBOX_NONE) > + setup_capabilities(g_strdup(lo->modcaps)); > }
I'd rather keep capabilities and sandboxing separate. Since I already added modcaps= how about just letting that take a varient as '-o modcaps=keep' Dave > /* Set the maximum number of open file descriptors */ > -- > 2.25.4 > -- Dr. David Alan Gilbert / [email protected] / Manchester, UK _______________________________________________ Virtio-fs mailing list [email protected] https://www.redhat.com/mailman/listinfo/virtio-fs
