| Message ID | 1457343286-16019-1-git-send-email-mrezanin@redhat.com |
|---|---|
| State | New |
| Headers | show |
On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote: > From: Miroslav Rezanina <mrezanin@redhat.com> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > so qemu using rbd image hang after start when run in sandbox mode. > > To allow using rbd images in sandbox mode we have to whitelist it. > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > --- > qemu-seccomp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 2866e3c..e29fca1 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > #ifdef HAVE_CACHEFLUSH > { SCMP_SYS(cacheflush), 240 }, > #endif > + { SCMP_SYS(sysinfo), 240 }, Are you sure you want to add this syscall to the bottom of the list? Did you estimate the frequency it is called by running strace? Thanks for the patch.
----- 元のメッセージ ----- > 差出人: "Eduardo Otubo" <eduardo.otubo@profitbricks.com> > 宛先: mrezanin@redhat.com > Cc: qemu-devel@nongnu.org, armbru@redhat.com > 送信済み: 2016年3月11日, 金曜日 午前 9:51:50 > 件名: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call > > On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote: > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > so qemu using rbd image hang after start when run in sandbox mode. > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > --- > > qemu-seccomp.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > index 2866e3c..e29fca1 100644 > > --- a/qemu-seccomp.c > > +++ b/qemu-seccomp.c > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall > > seccomp_whitelist[] = { > > #ifdef HAVE_CACHEFLUSH > > { SCMP_SYS(cacheflush), 240 }, > > #endif > > + { SCMP_SYS(sysinfo), 240 }, > > Are you sure you want to add this syscall to the bottom of the list? Did > you estimate the frequency it is called by running strace? > > Thanks for the patch. > Hi, Yes, it wasn't used before nss update and now is used only for rbd based images where it is called just few times upon start so drawback should be minimal. With this we do not change cost of other calls. Thanks for review and question, Mirek > -- > Eduardo Otubo > ProfitBricks GmbH >
On Mon, Mar 21, 2016 at 08=17=45AM -0400, Miroslav Rezanina wrote: > > > ----- 元のメッセージ ----- > > 差出人: "Eduardo Otubo" <eduardo.otubo@profitbricks.com> > > 宛先: mrezanin@redhat.com > > Cc: qemu-devel@nongnu.org, armbru@redhat.com > > 送信済み: 2016年3月11日, 金曜日 午前 9:51:50 > > 件名: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call > > > > On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote: > > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > > so qemu using rbd image hang after start when run in sandbox mode. > > > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > > --- > > > qemu-seccomp.c | 1 + > > > 1 file changed, 1 insertion(+) > > > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > > index 2866e3c..e29fca1 100644 > > > --- a/qemu-seccomp.c > > > +++ b/qemu-seccomp.c > > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall > > > seccomp_whitelist[] = { > > > #ifdef HAVE_CACHEFLUSH > > > { SCMP_SYS(cacheflush), 240 }, > > > #endif > > > + { SCMP_SYS(sysinfo), 240 }, > > > > Are you sure you want to add this syscall to the bottom of the list? Did > > you estimate the frequency it is called by running strace? > > > > Thanks for the patch. > > > Hi, > > Yes, it wasn't used before nss update and now is used only for rbd based images > where it is called just few times upon start so drawback should be minimal. With > this we do not change cost of other calls. > > Thanks for review and question, > Mirek Ok. So, ACK on this patch. I'll roll out a pull request by the end of the day. Thanks for the contribution.
Quoting mrezanin@redhat.com (mrezanin@redhat.com): > From: Miroslav Rezanina <mrezanin@redhat.com> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > so qemu using rbd image hang after start when run in sandbox mode. > > To allow using rbd images in sandbox mode we have to whitelist it. > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> Thanks. Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> > --- > qemu-seccomp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 2866e3c..e29fca1 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > #ifdef HAVE_CACHEFLUSH > { SCMP_SYS(cacheflush), 240 }, > #endif > + { SCMP_SYS(sysinfo), 240 }, > }; > > int seccomp_start(void) > -- > 2.5.0 > >
On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote: > Quoting mrezanin@redhat.com (mrezanin@redhat.com): > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > so qemu using rbd image hang after start when run in sandbox mode. > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > Thanks. > > Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Also: I'll change the subject of this email a little bit for a cleaner and more explicit commit. Thanks. > > > --- > > qemu-seccomp.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > index 2866e3c..e29fca1 100644 > > --- a/qemu-seccomp.c > > +++ b/qemu-seccomp.c > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > > #ifdef HAVE_CACHEFLUSH > > { SCMP_SYS(cacheflush), 240 }, > > #endif > > + { SCMP_SYS(sysinfo), 240 }, > > }; > > > > int seccomp_start(void) > > -- > > 2.5.0 > > > > >
----- 元のメッセージ ----- > 差出人: "Eduardo Otubo" <eduardo.otubo@profitbricks.com> > 宛先: "Serge Hallyn" <serge.hallyn@ubuntu.com> > Cc: mrezanin@redhat.com, qemu-devel@nongnu.org, armbru@redhat.com > 送信済み: 2016年4月12日, 火曜日 午後 1:53:47 > 件名: Re: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call > > On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote: > > Quoting mrezanin@redhat.com (mrezanin@redhat.com): > > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > > so qemu using rbd image hang after start when run in sandbox mode. > > > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > > > Thanks. > > > > Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> > > Also: I'll change the subject of this email a little bit for a cleaner > and more explicit commit. > > Thanks. Ok, thanks. Mirek > > > > > > --- > > > qemu-seccomp.c | 1 + > > > 1 file changed, 1 insertion(+) > > > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > > index 2866e3c..e29fca1 100644 > > > --- a/qemu-seccomp.c > > > +++ b/qemu-seccomp.c > > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall > > > seccomp_whitelist[] = { > > > #ifdef HAVE_CACHEFLUSH > > > { SCMP_SYS(cacheflush), 240 }, > > > #endif > > > + { SCMP_SYS(sysinfo), 240 }, > > > }; > > > > > > int seccomp_start(void) > > > -- > > > 2.5.0 > > > > > > > > > > -- > Eduardo Otubo > ProfitBricks GmbH >
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 2866e3c..e29fca1 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { #ifdef HAVE_CACHEFLUSH { SCMP_SYS(cacheflush), 240 }, #endif + { SCMP_SYS(sysinfo), 240 }, }; int seccomp_start(void)