From 2e236dcf10f56f39efd285bf90777097fdf251a1 Mon Sep 17 00:00:00 2001 From: Pawel Stradomski Date: Wed, 13 Jun 2018 12:27:37 +0200 Subject: [PATCH] Allow passing ps-socket file descriptor when launching criu. This makes it possible to have the pageserver communication go over anonymous unix sockets, e.g. created by socketpair(). Such setup makes it easier to secure pageserver connection by wrapping it in an encrypted tunnel. It also helps prevent attacks where a malicious process connects to page server and injects its own stream of pages to either fool criu into restoring wrong pages or to DoS the pageserver by having it exhaust local storage by writing large .img files. Signed-off-by: Pawel Stradomski Signed-off-by: Andrei Vagin --- criu/crtools.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/criu/crtools.c b/criu/crtools.c index 238b04a70..bff53fe15 100644 --- a/criu/crtools.c +++ b/criu/crtools.c @@ -311,6 +311,7 @@ int main(int argc, char *argv[], char *envp[]) { "status-fd", required_argument, 0, 1088 }, BOOL_OPT(SK_CLOSE_PARAM, &opts.tcp_close), { "verbosity", optional_argument, 0, 'v' }, + { "ps-socket", required_argument, 0, 1091}, { }, }; @@ -615,6 +616,9 @@ int main(int argc, char *argv[], char *envp[]) return 1; } break; + case 1091: + opts.ps_socket = atoi(optarg); + break; case 'V': pr_msg("Version: %s\n", CRIU_VERSION); if (strcmp(CRIU_GITID, "0"))