From 5712173d080ac9a074a41d9d7a086f16e2bcbc94 Mon Sep 17 00:00:00 2001 From: 3405691582 Date: Wed, 24 Jun 2026 13:47:31 +0000 Subject: [PATCH] Disable crosvm sandboxing inside a sandbox. The sandbox may not have the seccomp policy directory set up; this may be redundant anyway. --- base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp b/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp index c43526e5970..5dc764b313b 100644 --- a/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp +++ b/base/cvd/cuttlefish/host/libs/vm_manager/crosvm_manager.cpp @@ -35,6 +35,7 @@ #include "cuttlefish/common/libs/utils/files.h" #include "cuttlefish/common/libs/utils/host_info.h" +#include "cuttlefish/common/libs/utils/in_sandbox.h" #include "cuttlefish/common/libs/utils/json.h" #include "cuttlefish/common/libs/utils/known_paths.h" #include "cuttlefish/common/libs/utils/network.h" @@ -714,7 +715,7 @@ Result> CrosvmManager::StartCommands( ",size=", FileSize(PstorePath(instance))); } - if (instance.enable_sandbox()) { + if (instance.enable_sandbox() && !InSandbox()) { const bool seccomp_exists = DirectoryExists(instance.seccomp_policy_dir()); const std::string& var_empty_dir = kCrosvmVarEmptyDir; const bool var_empty_available = DirectoryExists(var_empty_dir);