| Message ID | 20140306145017.1761.50037.stgit@localhost |
|---|---|
| State | New |
| Headers | show |
Il 06/03/2014 15:50, Paul Moore ha scritto: > When QEMU is used with Open vSwitch it is common to create netdev > script and downscript scripts that use the ovs-vsctl command to manage > the underlying network devices. Unfortunately, ovs-vsctl calls the > getrusage() syscall which is not currently present in the QEMU/seccomp > whistelist. > > Signed-off-by: Paul Moore <pmoore@redhat.com> > --- > qemu-seccomp.c | 3 ++- > 1 file changed, 2 insertions(+), 1 deletion(-) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index caa926e..86210a4 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -225,7 +225,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > { SCMP_SYS(fchmod), 240 }, > { SCMP_SYS(shmget), 240 }, > { SCMP_SYS(shmat), 240 }, > - { SCMP_SYS(shmdt), 240 } > + { SCMP_SYS(shmdt), 240 }, > + { SCMP_SYS(getrusage), 240 } > }; > > int seccomp_start(void) > > > NACK, when QEMU is used in sandbox mode you should use file descriptor passing instead. Paolo
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index caa926e..86210a4 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -225,7 +225,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(fchmod), 240 }, { SCMP_SYS(shmget), 240 }, { SCMP_SYS(shmat), 240 }, - { SCMP_SYS(shmdt), 240 } + { SCMP_SYS(shmdt), 240 }, + { SCMP_SYS(getrusage), 240 } }; int seccomp_start(void)
When QEMU is used with Open vSwitch it is common to create netdev script and downscript scripts that use the ovs-vsctl command to manage the underlying network devices. Unfortunately, ovs-vsctl calls the getrusage() syscall which is not currently present in the QEMU/seccomp whistelist. Signed-off-by: Paul Moore <pmoore@redhat.com> --- qemu-seccomp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-)