Re: [Qemu-devel] [PATCH] seccomp: "-sandbox on" won't kill Qemu when option not built in

[Eduardo Otubo <otubo@linux.vnet.ibm.com>]

On 12/10/2013 04:48 PM, Lucas Meneghel Rodrigues wrote:
> On 12/10/2013 01:20 AM, Corey Bryant wrote:
>>>> IMHO the test suite should probe to see if sandbox is working or not,
>>>> and
>>>> just not use the "-sandbox on" arg if the host doesn't support it.
>>>
>>> But I think this could be done on virt-test as well :)
>>>
>>
>> This would make sense.
>>
>> Although it sounds like Lucas was looking for an error message when
>> seccomp kills qemu.  Maybe virt-test could grep the audit log for the
>> existence of a "type=SECCOMP" record within the test's time of
>> execution, and issue a message based on that.
>
> It's a valid idea. The problem I see with it is that not every distro
> out there uses SELinux. Not getting into the merits of whether they
> should, ideally it'd be nice to have this working on distros that won't
> use SELinux.
>
>
>

Completely misunderstanding, I feel sorry for that.

While we can't rely on the fact that every distro will have audit log 
working properly, I can start working on some support for virt-test to 
detect if the host machine has support for seccomp or if the Qemu binary 
has this feature built in.

Again, sorry for the mess. Please disconsider this patch.

-- 
Eduardo Otubo
IBM Linux Technology Center