From b735547d962cba56751b536fe0e92aec77a7abe9 Mon Sep 17 00:00:00 2001 From: Pawel Stradomski Date: Wed, 13 Jun 2018 12:27:37 +0200 Subject: [PATCH] Allow passing ps-socket file descriptor when launching criu. This makes it possible to have the pageserver communication go over anonymous unix sockets, e.g. created by socketpair(). Such setup makes it easier to secure pageserver connection by wrapping it in an encrypted tunnel. It also helps prevent attacks where a malicious process connects to page server and injects its own stream of pages to either fool criu into restoring wrong pages or to DoS the pageserver by having it exhaust local storage by writing large .img files. Signed-off-by: Pawel Stradomski Signed-off-by: Andrei Vagin --- criu/crtools.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/criu/crtools.c b/criu/crtools.c index f7b7864ca..39bc609eb 100644 --- a/criu/crtools.c +++ b/criu/crtools.c @@ -356,6 +356,7 @@ int main(int argc, char *argv[], char *envp[]) BOOL_OPT("remote", &opts.remote), { "config", required_argument, 0, 1089}, { "no-default-config", no_argument, 0, 1090}, + { "ps-socket", required_argument, 0, 1091}, { }, }; @@ -684,6 +685,9 @@ int main(int argc, char *argv[], char *envp[]) break; case 1090: break; + case 1091: + opts.ps_socket = atoi(optarg); + break; case 'V': pr_msg("Version: %s\n", CRIU_VERSION); if (strcmp(CRIU_GITID, "0"))