[lxc-devel] [lxd/master] lxd/vm: Use -sandbox

[stgraber on Github]

A non-text attachment was scrubbed...
Name: not available
Type: text/x-mailbox
Size: 354 bytes
Desc: not available
URL: <http://lists.linuxcontainers.org/pipermail/lxc-devel/attachments/20200217/e3d40754/attachment.bin>
-------------- next part --------------
From e996772fe72671a3638bd327e49cd14dc3a103df Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Graber?= <stgraber at ubuntu.com>
Date: Mon, 17 Feb 2020 18:25:43 -0500
Subject: [PATCH] lxd/vm: Use -sandbox
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Signed-off-by: Stéphane Graber <stgraber at ubuntu.com>
---
 lxd/instance/drivers/driver_qemu.go | 1 +
 1 file changed, 1 insertion(+)

diff --git a/lxd/instance/drivers/driver_qemu.go b/lxd/instance/drivers/driver_qemu.go
index 160b8d5f15..010e56f111 100644
--- a/lxd/instance/drivers/driver_qemu.go
+++ b/lxd/instance/drivers/driver_qemu.go
@@ -711,6 +711,7 @@ func (vm *qemu) Start(stateful bool) error {
 		"-nodefaults",
 		"-no-reboot",
 		"-no-user-config",
+		"-sandbox", "on,obsolete=deny,elevateprivileges=allow,spawn=deny,resourcecontrol=deny",
 		"-readconfig", confFile,
 		"-pidfile", vm.pidFilePath(),
 		"-D", vm.LogFilePath(),