[PULL 1/8] seccomp: really fix blocking of setns/execveat/unshare

["Daniel P. Berrangé" <berrange@redhat.com>]

The previous fix for setns/execveat/unshare mistakenly copy and
pasted the clone_args filter, which is inappropriate for these
syscalls and had the effect of weakening the seccomp filter.

Fixes: f33fb19cab (seccomp: fix blocking of setns/execveat/unshare)
Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/4671
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 system/qemu-seccomp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/system/qemu-seccomp.c b/system/qemu-seccomp.c
index 3889d48b4f2..cd2c1b0b747 100644
--- a/system/qemu-seccomp.c
+++ b/system/qemu-seccomp.c
@@ -250,12 +250,12 @@ static const struct QemuSeccompSyscall denylist[] = {
 #endif
 #ifdef __SNR_execveat
     { SCMP_SYS(execveat),               QEMU_SECCOMP_SET_SPAWN,
-      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+      0, NULL, SCMP_ACT_ERRNO(EPERM) },
 #endif
     { SCMP_SYS(setns),                  QEMU_SECCOMP_SET_SPAWN,
-      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+      0, NULL, SCMP_ACT_ERRNO(EPERM) },
     { SCMP_SYS(unshare),                QEMU_SECCOMP_SET_SPAWN,
-      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+      0, NULL, SCMP_ACT_ERRNO(EPERM) },
     /* resource control */
     { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL,
       0, NULL, SCMP_ACT_ERRNO(EPERM) },
-- 
2.56.0