From patchwork Fri Sep 21 12:40:33 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eduardo Otubo X-Patchwork-Id: 185726 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id C28A02C0088 for ; Fri, 21 Sep 2012 22:40:58 +1000 (EST) Received: from localhost ([::1]:35762 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TF2XQ-0006fp-T1 for incoming@patchwork.ozlabs.org; Fri, 21 Sep 2012 08:40:56 -0400 Received: from eggs.gnu.org ([208.118.235.92]:36308) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TF2XJ-0006fc-LO for qemu-devel@nongnu.org; Fri, 21 Sep 2012 08:40:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TF2XD-0008H5-Qr for qemu-devel@nongnu.org; Fri, 21 Sep 2012 08:40:49 -0400 Received: from e24smtp05.br.ibm.com ([32.104.18.26]:51585) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TF2XD-0008Gq-Cc for qemu-devel@nongnu.org; Fri, 21 Sep 2012 08:40:43 -0400 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Sep 2012 09:40:39 -0300 Received: from d24dlp01.br.ibm.com (9.18.248.204) by e24smtp05.br.ibm.com (10.172.0.141) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Fri, 21 Sep 2012 09:40:37 -0300 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 4F28E352001A for ; Fri, 21 Sep 2012 08:40:36 -0400 (EDT) Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q8LCeWL31253538 for ; Fri, 21 Sep 2012 09:40:32 -0300 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q8LCeZKP011152 for ; Fri, 21 Sep 2012 09:40:35 -0300 Received: from vader.br.ibm.com (dhcp-9-7-38-185.br.ibm.com [9.7.38.185]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q8LCeZAI011149; Fri, 21 Sep 2012 09:40:35 -0300 From: Eduardo Otubo To: qemu-devel@nongnu.org Date: Fri, 21 Sep 2012 09:40:33 -0300 Message-Id: <1348231233-29841-1-git-send-email-otubo@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.12 In-Reply-To: <505C4DA3.8020009@redhat.com> References: <505C4DA3.8020009@redhat.com> X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12092112-2362-0000-0000-0000087C6CF7 X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 32.104.18.26 Cc: Eduardo Otubo Subject: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Seccomp syscall whitelist updated after tests running qemu under libvirt. Reference to the bug - https://bugzilla.redhat.com/show_bug.cgi?id=855162 Signed-off-by: Eduardo Otubo --- qemu-seccomp.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 64329a3..4712338 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(setsockopt), 245}, { SCMP_SYS(uname), 245}, { SCMP_SYS(semget), 245}, + { SCMP_SYS(accept4), 241 }, #endif { SCMP_SYS(eventfd2), 245 }, { SCMP_SYS(dup), 245 }, @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, { SCMP_SYS(getpeername), 242 }, { SCMP_SYS(fdatasync), 242 }, - { SCMP_SYS(close), 242 } + { SCMP_SYS(close), 242 }, + { SCMP_SYS(unlink), 241 }, + { SCMP_SYS(statfs), 241 }, + { SCMP_SYS(getuid), 241 }, + { SCMP_SYS(ftruncate), 241 }, + { SCMP_SYS(getegid), 241 }, + { SCMP_SYS(geteuid), 241 }, + { SCMP_SYS(getgid), 241 }, + { SCMP_SYS(getrlimit), 241 }, + { SCMP_SYS(set_tid_address), 241 }, + { SCMP_SYS(socketpair), 241 }, + { SCMP_SYS(fstatfs), 241 }, + { SCMP_SYS(epoll_create), 241 }, + { SCMP_SYS(epoll_ctl), 241 }, + { SCMP_SYS(epoll_wait), 241 }, + { SCMP_SYS(pipe), 241 }, + { SCMP_SYS(poll), 241 }, + { SCMP_SYS(rt_sigpending), 241 }, + { SCMP_SYS(rt_sigtimedwait), 241 }, }; int seccomp_start(void)