From patchwork Tue Jul 17 19:19:15 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Subject: [PATCHv4,4/4] Adding seccomp calls to vl.c Date: Tue, 17 Jul 2012 09:19:15 -0000 From: Eduardo Otubo X-Patchwork-Id: 171542 Message-Id: <98962f4d0fbdbc4363b813c8e18072eb7628bf48.1342552002.git.otubo@linux.vnet.ibm.com> To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, blauwirbel@gmail.com, anthony@codemonkey.ws, wad@chromium.org, Eduardo Otubo v1: * Full seccomp calls and data included in vl.c v2: * Full seccomp calls and data removed from vl.c and put into separate qemu-seccomp.[ch] file. v4: * Call to install_seccomp_syscall_debug() added. * Now calling seccomp_start() with 'SECCOMP_MODE' argument, depending on settings used in configure script. Signed-off-by: Eduardo Otubo --- vl.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/vl.c b/vl.c index 46248b9..8dc9432 100644 --- a/vl.c +++ b/vl.c @@ -62,6 +62,14 @@ #include #include #endif + +#ifdef CONFIG_SECCOMP +#include "qemu-seccomp.h" +#endif +#ifdef CONFIG_SECCOMP_DEBUG +#include "qemu-seccomp-debug.h" +#endif + #ifdef __sun__ #include #include @@ -169,6 +177,14 @@ int main(int argc, char **argv) #define MAX_VIRTIO_CONSOLES 1 +#ifdef CONFIG_SECCOMP +#ifdef CONFIG_SECCOMP_DEBUG +#define SECCOMP_MODE SCMP_ACT_TRAP +#else +#define SECCOMP_MODE SCMP_ACT_KILL +#endif +#endif + static const char *data_dir; const char *bios_name = NULL; enum vga_retrace_method vga_retrace_method = VGA_RETRACE_DUMB; @@ -2295,6 +2311,21 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; +#ifdef CONFIG_SECCOMP_DEBUG + if (install_seccomp_syscall_debug()) { + fprintf(stderr, "seccomp: failed to install system call debug\n"); + exit(1); + } +#endif + +#ifdef CONFIG_SECCOMP + if (seccomp_start(SECCOMP_MODE) < 0) { + fprintf(stderr, + "seccomp: failed to install syscall filter in the kernel\n"); + exit(1); + } +#endif + atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]);