Patchwork seccomp: add additional asynchronous I/O syscalls

login
register
mail settings
Submitter Paul Moore
Date July 15, 2013, 7:32 p.m.
Message ID <20130715193201.943.4913.stgit@localhost>
Download mbox | patch
Permalink /patch/259175/
State New
Headers show

Comments

Paul Moore - July 15, 2013, 7:32 p.m.
A previous commit, "seccomp: add the asynchronous I/O syscalls to the
whitelist", added several asynchronous I/O syscalls but left out the
io_submit() and io_cancel() syscalls.  This patch corrects this by
adding the two missing asynchronous I/O syscalls.

Signed-off-by: Paul Moore <pmoore@redhat.com>
---
 qemu-seccomp.c |    2 ++
 1 file changed, 2 insertions(+)
Paul Moore - July 23, 2013, 1:57 p.m.
On Monday, July 15, 2013 03:32:01 PM Paul Moore wrote:
> A previous commit, "seccomp: add the asynchronous I/O syscalls to the
> whitelist", added several asynchronous I/O syscalls but left out the
> io_submit() and io_cancel() syscalls.  This patch corrects this by
> adding the two missing asynchronous I/O syscalls.
> 
> Signed-off-by: Paul Moore <pmoore@redhat.com>

A gentle nudge so this fix doesn't get forgotten.

> ---
>  qemu-seccomp.c |    2 ++
>  1 file changed, 2 insertions(+)
> 
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index ca123bf..173d185 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -33,6 +33,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[]
> = { { SCMP_SYS(socketcall), 250 },
>  #endif
>      { SCMP_SYS(read), 249 },
> +    { SCMP_SYS(io_submit), 249 },
>      { SCMP_SYS(brk), 248 },
>      { SCMP_SYS(clone), 247 },
>      { SCMP_SYS(mmap), 247 },
> @@ -231,6 +232,7 @@ static const struct QemuSeccompSyscall
> seccomp_whitelist[] = { { SCMP_SYS(recvmmsg), 241 },
>      { SCMP_SYS(prlimit64), 241 },
>      { SCMP_SYS(waitid), 241 },
> +    { SCMP_SYS(io_cancel), 241 },
>      { SCMP_SYS(io_setup), 241 },
>      { SCMP_SYS(io_destroy), 241 }
>  };
Eduardo Otubo - July 24, 2013, 6:02 p.m.
On 07/23/2013 10:57 AM, Paul Moore wrote:
> On Monday, July 15, 2013 03:32:01 PM Paul Moore wrote:
>> A previous commit, "seccomp: add the asynchronous I/O syscalls to the
>> whitelist", added several asynchronous I/O syscalls but left out the
>> io_submit() and io_cancel() syscalls.  This patch corrects this by
>> adding the two missing asynchronous I/O syscalls.
>>
>> Signed-off-by: Paul Moore <pmoore@redhat.com>
>
> A gentle nudge so this fix doesn't get forgotten.

Reviewed and tested.

Reviewed-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>

>
>> ---
>>   qemu-seccomp.c |    2 ++
>>   1 file changed, 2 insertions(+)
>>
>> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
>> index ca123bf..173d185 100644
>> --- a/qemu-seccomp.c
>> +++ b/qemu-seccomp.c
>> @@ -33,6 +33,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[]
>> = { { SCMP_SYS(socketcall), 250 },
>>   #endif
>>       { SCMP_SYS(read), 249 },
>> +    { SCMP_SYS(io_submit), 249 },
>>       { SCMP_SYS(brk), 248 },
>>       { SCMP_SYS(clone), 247 },
>>       { SCMP_SYS(mmap), 247 },
>> @@ -231,6 +232,7 @@ static const struct QemuSeccompSyscall
>> seccomp_whitelist[] = { { SCMP_SYS(recvmmsg), 241 },
>>       { SCMP_SYS(prlimit64), 241 },
>>       { SCMP_SYS(waitid), 241 },
>> +    { SCMP_SYS(io_cancel), 241 },
>>       { SCMP_SYS(io_setup), 241 },
>>       { SCMP_SYS(io_destroy), 241 }
>>   };
Paul Moore - July 29, 2013, 10:12 p.m.
On Wednesday, July 24, 2013 03:02:23 PM Eduardo Otubo wrote:
> On 07/23/2013 10:57 AM, Paul Moore wrote:
> > On Monday, July 15, 2013 03:32:01 PM Paul Moore wrote:
> >> A previous commit, "seccomp: add the asynchronous I/O syscalls to the
> >> whitelist", added several asynchronous I/O syscalls but left out the
> >> io_submit() and io_cancel() syscalls.  This patch corrects this by
> >> adding the two missing asynchronous I/O syscalls.
> >> 
> >> Signed-off-by: Paul Moore <pmoore@redhat.com>
> > 
> > A gentle nudge so this fix doesn't get forgotten.
> 
> Reviewed and tested.
> 
> Reviewed-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>

Any chance of merging this patch?

> >> ---
> >> 
> >>   qemu-seccomp.c |    2 ++
> >>   1 file changed, 2 insertions(+)
> >> 
> >> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> >> index ca123bf..173d185 100644
> >> --- a/qemu-seccomp.c
> >> +++ b/qemu-seccomp.c
> >> @@ -33,6 +33,7 @@ static const struct QemuSeccompSyscall
> >> seccomp_whitelist[] = { { SCMP_SYS(socketcall), 250 },
> >> 
> >>   #endif
> >>   
> >>       { SCMP_SYS(read), 249 },
> >> 
> >> +    { SCMP_SYS(io_submit), 249 },
> >> 
> >>       { SCMP_SYS(brk), 248 },
> >>       { SCMP_SYS(clone), 247 },
> >>       { SCMP_SYS(mmap), 247 },
> >> 
> >> @@ -231,6 +232,7 @@ static const struct QemuSeccompSyscall
> >> seccomp_whitelist[] = { { SCMP_SYS(recvmmsg), 241 },
> >> 
> >>       { SCMP_SYS(prlimit64), 241 },
> >>       { SCMP_SYS(waitid), 241 },
> >> 
> >> +    { SCMP_SYS(io_cancel), 241 },
> >> 
> >>       { SCMP_SYS(io_setup), 241 },
> >>       { SCMP_SYS(io_destroy), 241 }
> >>   
> >>   };
Anthony Liguori - Aug. 2, 2013, 12:35 p.m.
Applied.  Thanks.

Regards,

Anthony Liguori

Patch

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index ca123bf..173d185 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -33,6 +33,7 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(socketcall), 250 },
 #endif
     { SCMP_SYS(read), 249 },
+    { SCMP_SYS(io_submit), 249 },
     { SCMP_SYS(brk), 248 },
     { SCMP_SYS(clone), 247 },
     { SCMP_SYS(mmap), 247 },
@@ -231,6 +232,7 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(recvmmsg), 241 },
     { SCMP_SYS(prlimit64), 241 },
     { SCMP_SYS(waitid), 241 },
+    { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
     { SCMP_SYS(io_destroy), 241 }
 };