Re: Why is /run/vm/by-id/${VM} writable by the VMM?

[Alyssa Ross <hi@alyssa.is>]

[-- Attachment #1: Type: text/plain, Size: 1315 bytes --]

Demi Marie Obenour <demiobenour@gmail.com> writes:

> On 7/13/26 05:04, Alyssa Ross wrote:
>> Demi Marie Obenour <demiobenour@gmail.com> writes:
>> 
>>> This seems to be a fairly significant hole in the VMM's sandbox.
>>> Various code operates in that directory and isn't secure against
>>> symlink attacks.
>>>
>>> Does the VMM really need write access to that directory?  Could it
>>> be given access to a subdirectory that is mounted "nosymfollow"?
>> 
>> I think it's just so it can create e.g. the serial file.  That could
>> indeed be moved to a subdirectory.  The ideal solution is of course for
>> Cloud Hypervisor to be able to accept every file it would otherwise
>> create as an open file descriptor, which I expect will happen
>> eventually.
>
> Should it be moved to a subdirectory for now?  That would make the
> sandbox meaningful in practice.

I suppose it could be.  Might make more sense to dedicate efforts
towards fixing Cloud Hypervisor to accept file descriptors for the ~2
paths it currently needs to create, though.  (That's obviously more
work, but also more useful.)  If we were to work around this in
Spectrum, we could keep symlinks outside the directory pointing into it,
to keep paths nice and avoid churn once we can put them back in the
parent directory.

[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 227 bytes --]