commit 20333e41aeac0547f6db019245f5df12957114ff
author Lepton Wu <lepton@chromium.org> Thu Mar 14 10:48:03 2019 -0700
committer chrome-bot <chrome-bot@chromium.org> Sat Mar 16 20:31:35 2019 -0700
tree 282e8158d4de4ec72cae577318863dea6176036d
parent fbbcf7ad1457b5daff1be151793441006f186683

Don't drop capabilities when sandbox is disabled.

BUG=b:128465119
TEST=manual - Run ARCVM

Change-Id: Ib6d43a74a98d4f29498ad62168d0efbd4c77fc83
Reviewed-on: https://chromium-review.googlesource.com/1524370
Commit-Ready: Lepton Wu <lepton@chromium.org>
Tested-by: Lepton Wu <lepton@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Lepton Wu <lepton@chromium.org>

src/linux.rs

diff --git a/src/linux.rs b/src/linux.rs
index e7583a4..37910f4 100644
--- a/src/linux.rs
+++ b/src/linux.rs
@@ -1121,6 +1121,7 @@
         disk_host_sockets.push(disk_host_socket);
     }
 
+    let sandbox = cfg.sandbox;
     let linux = Arch::build_vm(components, cfg.split_irqchip, |m, e| {
         create_devices(
             cfg,
@@ -1175,6 +1176,7 @@
         &disk_host_sockets,
         sigchld_fd,
         _render_node_host,
+        sandbox,
     )
 }
 
@@ -1186,6 +1188,7 @@
     disk_host_sockets: &[MsgSocket<VmRequest, VmResponse>],
     sigchld_fd: SignalFd,
     _render_node_host: RenderNodeHost,
+    sandbox: bool,
 ) -> Result<()> {
     // Paths to get the currently available memory and the low memory threshold.
     const LOWMEM_MARGIN: &str = "/sys/kernel/mm/chromeos-low_mem/margin";
@@ -1278,8 +1281,10 @@
             .subsec_nanos() as u64,
     );
 
-    // Before starting VCPUs, in case we started with some capabilities, drop them all.
-    drop_capabilities().map_err(Error::DropCapabilities)?;
+    if sandbox {
+        // Before starting VCPUs, in case we started with some capabilities, drop them all.
+        drop_capabilities().map_err(Error::DropCapabilities)?;
+    }
 
     let mut vcpu_handles = Vec::with_capacity(linux.vcpus.len());
     let vcpu_thread_barrier = Arc::new(Barrier::new(linux.vcpus.len() + 1));