diff options
| author | Michael Pratt <mpratt@google.com> | 2019-06-05 13:59:01 -0700 |
|---|---|---|
| committer | Shentubot <shentubot@google.com> | 2019-06-05 14:00:13 -0700 |
| commit | d3ed9baac0dc967eaf6d3e3f986cafe60604121a (patch) | |
| tree | 47121539775297207ba205b60b136c9093d5d393 /pkg/sentry/mm/mm.go | |
| parent | cecb71dc37a77d8e4e88cdfada92a37a72c67602 (diff) | |
Implement dumpability tracking and checks
We don't actually support core dumps, but some applications want to
get/set dumpability, which still has an effect in procfs.
Lack of support for set-uid binaries or fs creds simplifies things a
bit.
As-is, processes started via CreateProcess (i.e., init and sentryctl
exec) have normal dumpability. I'm a bit torn on whether sentryctl exec
tasks should be dumpable, but at least since they have no parent normal
UID/GID checks should protect them.
PiperOrigin-RevId: 251712714
Diffstat (limited to 'pkg/sentry/mm/mm.go')
| -rw-r--r-- | pkg/sentry/mm/mm.go | 6 |
1 files changed, 6 insertions, 0 deletions
diff --git a/pkg/sentry/mm/mm.go b/pkg/sentry/mm/mm.go index eb6defa2b..0a026ff8c 100644 --- a/pkg/sentry/mm/mm.go +++ b/pkg/sentry/mm/mm.go @@ -219,6 +219,12 @@ type MemoryManager struct { // executable is protected by metadataMu. executable *fs.Dirent + // dumpability describes if and how this MemoryManager may be dumped to + // userspace. + // + // dumpability is protected by metadataMu. + dumpability Dumpability + // aioManager keeps track of AIOContexts used for async IOs. AIOManager // must be cloned when CLONE_VM is used. aioManager aioManager |