4 ms·
Unfortunately, Cloud Hypervisor does not use strong sandboxing/privilege separation like crosvm does.
by nolist_policy 3y ago
Unfortunately, Cloud Hypervisor does not use strong sandboxing/privilege separation like crosvm does.
- yencabulator 3y agoFor anyone else wanting to check on the status of this: it seems they're looking at a combination of seccomp, landlock and a systemd service instance per VM, with systemd doing DynamicUser, namespacing, and initial seccomp. Work seems to be happening right now, but of course it's telling and sad that it wasn't part of the original design. https://github.com/cloud-hypervisor/cloud-hypervisor/issues/5170 https://github.com/cloud-hypervisor/cloud-hypervisor/issues/...