Disallow running Graphene as root

Signed-off-by: Borys Popławski <borysp@invisiblethingslab.com>
gramineproject · Aug 18, 2021 · 02c9419 · 02c9419
1 parent 398727e
commit 02c9419
Showing 1 changed file with 9 additions and 0 deletions.
diff --git a/Runtime/pal_loader b/Runtime/pal_loader
@@ -22,6 +22,15 @@ then
     exit 1
 fi
 
+if [ "00" -eq "0$(id -u 2>/dev/null)" ]
+then
+    if tail /proc/kallsyms 2>/dev/null | grep -q ffff
+    then
+        echo "Please don't run Graphene as root!" >&2
+        exit 1
+    fi
+fi
+
 PAL_CMD=@PAL_CMD@
 LIBPAL_PATH=@LIBPAL_PATH@
 HOST_PAL_PATH=@HOST_PAL_PATH@