From 20333e41aeac0547f6db019245f5df12957114ff Mon Sep 17 00:00:00 2001 From: Lepton Wu Date: Thu, 14 Mar 2019 10:48:03 -0700 Subject: [PATCH] Don't drop capabilities when sandbox is disabled. BUG=b:128465119 TEST=manual - Run ARCVM Change-Id: Ib6d43a74a98d4f29498ad62168d0efbd4c77fc83 Reviewed-on: https://chromium-review.googlesource.com/1524370 Commit-Ready: Lepton Wu Tested-by: Lepton Wu Tested-by: kokoro Reviewed-by: Lepton Wu --- src/linux.rs | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/src/linux.rs b/src/linux.rs index e7583a4393..37910f4ad5 100644 --- a/src/linux.rs +++ b/src/linux.rs @@ -1121,6 +1121,7 @@ pub fn run_config(cfg: Config) -> Result<()> { disk_host_sockets.push(disk_host_socket); } + let sandbox = cfg.sandbox; let linux = Arch::build_vm(components, cfg.split_irqchip, |m, e| { create_devices( cfg, @@ -1175,6 +1176,7 @@ pub fn run_config(cfg: Config) -> Result<()> { &disk_host_sockets, sigchld_fd, _render_node_host, + sandbox, ) } @@ -1186,6 +1188,7 @@ fn run_control( disk_host_sockets: &[MsgSocket], sigchld_fd: SignalFd, _render_node_host: RenderNodeHost, + sandbox: bool, ) -> Result<()> { // Paths to get the currently available memory and the low memory threshold. const LOWMEM_MARGIN: &str = "/sys/kernel/mm/chromeos-low_mem/margin"; @@ -1278,8 +1281,10 @@ fn run_control( .subsec_nanos() as u64, ); - // Before starting VCPUs, in case we started with some capabilities, drop them all. - drop_capabilities().map_err(Error::DropCapabilities)?; + if sandbox { + // Before starting VCPUs, in case we started with some capabilities, drop them all. + drop_capabilities().map_err(Error::DropCapabilities)?; + } let mut vcpu_handles = Vec::with_capacity(linux.vcpus.len()); let vcpu_thread_barrier = Arc::new(Barrier::new(linux.vcpus.len() + 1));