@@ -96,6 +96,16 @@ common-obj-y += qemu-timer.o qemu-timer-common.o
common-obj-$(CONFIG_SLIRP) += slirp/
######################################################################
+# libseccomp
+ifeq ($(CONFIG_SECCOMP),y)
+common-obj-y += qemu-seccomp.o
+endif
+
+ifeq ($(CONFIG_SECCOMP_DEBUG),y)
+common-obj-y += qemu-seccomp-debug.o
+endif
+
+######################################################################
# libuser
user-obj-y =
@@ -195,6 +195,8 @@ zlib="yes"
guest_agent="yes"
libiscsi=""
coroutine=""
+seccomp="yes"
+seccomp_debug="no"
# parse CC options first
for opt do
@@ -824,6 +826,14 @@ for opt do
;;
--disable-guest-agent) guest_agent="no"
;;
+ --enable-seccomp-debug) seccomp_debug="yes"
+ ;;
+ --disable-seccomp-debug) seccomp_debug="no"
+ ;;
+ --enable-seccomp) seccomp="yes"
+ ;;
+ --disable-seccomp) seccomp="no"
+ ;;
*) echo "ERROR: unknown option $opt"; show_help="yes"
;;
esac
@@ -1108,6 +1118,10 @@ echo " --disable-usb-redir disable usb network redirection support"
echo " --enable-usb-redir enable usb network redirection support"
echo " --disable-guest-agent disable building of the QEMU Guest Agent"
echo " --enable-guest-agent enable building of the QEMU Guest Agent"
+echo " --disable-seccomp-debug disable seccomp debug support"
+echo " --enable-seccomp-debug enables seccomp debug support"
+echo " --disable-seccomp disable seccomp support"
+echo " --enable-seccomp enables seccomp support"
echo " --with-coroutine=BACKEND coroutine backend. Supported options:"
echo " gthread, ucontext, sigaltstack, windows"
echo ""
@@ -1369,6 +1383,16 @@ EOF
fi
##########################################
+# libseccomp check
+
+if test "$seccomp" = "yes" ; then
+ if $pkg_config libseccomp --modversion >/dev/null 2>&1; then
+ LIBS=`$pkg_config --libs libseccomp`
+ else
+ feature_not_found "libseccomp"
+ fi
+fi
+##########################################
# xen probe
if test "$xen" != "no" ; then
@@ -3053,6 +3077,8 @@ echo "usb net redir $usb_redir"
echo "OpenGL support $opengl"
echo "libiscsi support $libiscsi"
echo "build guest agent $guest_agent"
+echo "seccomp support $seccomp"
+echo "seccomp debug $seccomp_debug"
echo "coroutine backend $coroutine_backend"
if test "$sdl_too_old" = "yes"; then
@@ -3351,6 +3377,14 @@ if test "$libiscsi" = "yes" ; then
echo "CONFIG_LIBISCSI=y" >> $config_host_mak
fi
+if test "$seccomp" = "yes"; then
+ echo "CONFIG_SECCOMP=y" >> $config_host_mak
+fi
+
+if test "$seccomp_debug" = "yes"; then
+ echo "CONFIG_SECCOMP_DEBUG=y" >> $config_host_mak
+fi
+
# XXX: suppress that
if [ "$bsd" = "yes" ] ; then
echo "CONFIG_BSD=y" >> $config_host_mak
Adding basic options to the configure script to use libseccomp or not. The default is set to 'no'. If the flag --enable-libseccomp is used, the script will check for its existence using pkg-config. v2: * As I removed all the code related to seccomp from vl.c, I created qemu-seccomp.[ch]. * Also making the configure script to add the specific line to Makefile.obj in order to compile with appropriate support to seccomp. v3: * Removing the line from Makefile.obj and adding it to Makefile.objs. * Marking libseccomp default option to 'yes' in the configure script. v4: * Now two new options added: --enable-seccomp-debug --disable-seccomp-debug Enabling debug will cause libseccomp to be configured with SCMP_ACT_TRAP. This will help users/developers to catch system calls that were not previously whitelisted. Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> --- Makefile.objs | 10 ++++++++++ configure | 34 ++++++++++++++++++++++++++++++++++ 2 files changed, 44 insertions(+)