On 7/13/26 05:04, Alyssa Ross wrote:
> Demi Marie Obenour <demiobenour@gmail.com> writes:
> 
>> This seems to be a fairly significant hole in the VMM's sandbox.
>> Various code operates in that directory and isn't secure against
>> symlink attacks.
>>
>> Does the VMM really need write access to that directory?  Could it
>> be given access to a subdirectory that is mounted "nosymfollow"?
> 
> I think it's just so it can create e.g. the serial file.  That could
> indeed be moved to a subdirectory.  The ideal solution is of course for
> Cloud Hypervisor to be able to accept every file it would otherwise
> create as an open file descriptor, which I expect will happen
> eventually.

Should it be moved to a subdirectory for now?  That would make the
sandbox meaningful in practice.
-- 
Sincerely,
Demi Marie Obenour (she/her/hers)