Re: [libvirt] [systemd-devel] [PATCH] netns: unix: only allow to find out unix socket in same net namespace
On Wed, Aug 21, 2013 at 9:22 AM, Gao feng <gaofeng(a)cn.fujitsu.com> wrote:
On 08/21/2013 03:06 PM, Eric W. Biederman wrote:
> I suspect libvirt should simply not share /run or any other
normally
> writable directory with the host. Sharing /run /var/run or even /tmp
> seems extremely dubious if you want some kind of containment, and
> without strange things spilling through.
Right, /run or /var cannot be shared. It's not only about sockets,
many other things will also go really wrong that way.
right now I only take note of the unix socket /run/systemd/private,
but there may have many similar unix sockets, they can exist in any
path. the strange problems will still happen.
anyway, I will send a patch to setup a fresh tmpfs for the /run directory of
container first.
This is what systemd-nspawn does for a container setup:
http://cgit.freedesktop.org/systemd/systemd/tree/src/nspawn/nspawn.c#n350
Kay