mirror of
https://github.com/kata-containers/kata-containers.git
synced 2025-10-22 20:39:41 +00:00
93658b550c
Apply the upstream patch that fixes OBS fixes #690 Signed-off-by: Julio Montes <julio.montes@intel.com>
44 lines
1.5 KiB
Diff
44 lines
1.5 KiB
Diff
From f116c58ab18762b1fdf5b5908af8612bf933d159 Mon Sep 17 00:00:00 2001
|
|
From: Julio Montes <julio.montes@intel.com>
|
|
Date: Mon, 8 Jul 2019 21:19:36 +0000
|
|
Subject: [PATCH 2/3] memory-backend-file/nvdimm: support read-only files as
|
|
memory-backends
|
|
|
|
Currently is not possible to use a file that is part of a read-only
|
|
filesystem as memory backend for nvdimm devices, even if this is not modified
|
|
in the guest. In order to improve the security of Virtual Machines that share
|
|
and do not modify the memory-backend-file, QEMU should support
|
|
read-only memory-backeds.
|
|
|
|
Use case:
|
|
* Kata Containers use a memory-backed-file as read-only rootfs, and this
|
|
file is used to start all the virtual machines in the node.
|
|
It would be really bad if somehow a malicious container modified it.
|
|
|
|
Signed-off-by: Julio Montes <julio.montes@intel.com>
|
|
Message-Id: <20190708211936.8037-1-julio.montes@intel.com>
|
|
---
|
|
exec.c | 6 ++++++
|
|
1 file changed, 6 insertions(+)
|
|
|
|
diff --git a/exec.c b/exec.c
|
|
index 3e78de3b8f..a1b6f939fb 100644
|
|
--- a/exec.c
|
|
+++ b/exec.c
|
|
@@ -1865,6 +1865,12 @@ static int file_ram_open(const char *path,
|
|
break;
|
|
}
|
|
g_free(filename);
|
|
+ } else if (errno == EROFS) {
|
|
+ fd = open(path, O_RDONLY);
|
|
+ if (fd >= 0) {
|
|
+ /* @path names an existing read-only file, use it */
|
|
+ break;
|
|
+ }
|
|
}
|
|
if (errno != EEXIST && errno != EINTR) {
|
|
error_setg_errno(errp, errno,
|
|
--
|
|
2.17.2
|
|
|