Demi Marie Obenour <demiobenour@gmail.com> writes:

> This seems to be a fairly significant hole in the VMM's sandbox.
> Various code operates in that directory and isn't secure against
> symlink attacks.
>
> Does the VMM really need write access to that directory?  Could it
> be given access to a subdirectory that is mounted "nosymfollow"?

I think it's just so it can create e.g. the serial file.  That could
indeed be moved to a subdirectory.  The ideal solution is of course for
Cloud Hypervisor to be able to accept every file it would otherwise
create as an open file descriptor, which I expect will happen
eventually.