netbird/gvisor
0
0
Fork 0
mirror of https://github.com/netbirdio/gvisor.git synced 2026-05-22 17:12:49 -07:00
Code Issues Packages Projects Releases Wiki Activity

Move vfs restore to after seccomp installation.

Browse Source 
This ensure that device gofer connection is established after the seccomp
filters are installed.

Fixes #9767.

PiperOrigin-RevId: 586508528
This commit is contained in:
Ayush Ranjan
2023-11-29 18:26:41 -08:00
committed by gVisor bot
parent e12306b4b0
commit a7d2bf12c2
1 changed files with 12 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
runsc/boot/restore.go
+12 -11
View File
@@ -56,6 +56,18 @@ func (r *restorer) restore(l *Loader) error {
}
l.k.SetMemoryFile(mf)
if l.root.conf.ProfileEnable {
// pprof.Initialize opens /proc/self/maps, so has to be called before
// installing seccomp filters.
pprof.Initialize()
}
// Seccomp filters have to be applied before vfs restore and before parsing
// the state file.
if err := l.installSeccompFilters(); err != nil {
return err
}
// Set up the restore environment.
ctx := l.k.SupervisorContext()
// TODO(b/298078576): Need to process hints here probably
@@ -65,17 +77,6 @@ func (r *restorer) restore(l *Loader) error {
return fmt.Errorf("configuring filesystem restore: %v", err)
}
if l.root.conf.ProfileEnable {
// pprof.Initialize opens /proc/self/maps, so has to be called before
// installing seccomp filters.
pprof.Initialize()
}
// Seccomp filters have to be applied before parsing the state file.
if err := l.installSeccompFilters(); err != nil {
return err
}
// Load the state.
loadOpts := state.LoadOpts{Source: r.stateFile}
if err := loadOpts.Load(ctx, l.k, nil, curNetwork, time.NewCalibratedClocks(), &vfs.CompleteRestoreOptions{}); err != nil {