From 096e48669b56273d44a3242d7af4840b38335961 Mon Sep 17 00:00:00 2001 From: David Gibson Date: Fri, 14 Oct 2022 15:25:31 +1100 Subject: isolation: Clarify various self-isolation steps We have a number of steps of self-isolation scattered across our code. Improve function names and add comments to make it clearer what the self isolation model is, what the steps do, and why they happen at the points they happen. Signed-off-by: David Gibson Signed-off-by: Stefano Brivio --- passt.c | 8 +++----- 1 file changed, 3 insertions(+), 5 deletions(-) (limited to 'passt.c') diff --git a/passt.c b/passt.c index 7589b05..ff4ee5d 100644 --- a/passt.c +++ b/passt.c @@ -185,7 +185,7 @@ int main(int argc, char **argv) arch_avx2_exec(argv); - drop_caps(); + isolate_initial(); c.pasta_netns_fd = c.fd_tap = c.fd_tap_listen = -1; @@ -289,7 +289,7 @@ int main(int argc, char **argv) } } - if (sandbox(&c)) { + if (isolate_prefork(&c)) { err("Failed to sandbox process, exiting\n"); exit(EXIT_FAILURE); } @@ -299,9 +299,7 @@ int main(int argc, char **argv) else write_pidfile(pidfile_fd, getpid()); - prctl(PR_SET_DUMPABLE, 0); - - seccomp(&c); + isolate_postfork(&c); timer_init(&c, &now); -- cgit v1.2.3