Re: [PATCH 0/5] seccomp: fix hole in blocking forks

["Daniel P. Berrangé" <berrange@redhat.com>]

Hi Eduardo,

You acked this series, but going through my old git branches I
just discovered that this never got merged. I guess I was assuming
you had queued it for a future PULL when you acked it.

I don't mind sending a pull request myself if you've no objections.

On Wed, Aug 04, 2021 at 10:05:38AM +0200, Eduardo Terrell Ferrari Otubo wrote:
> On Mon, 2021-08-02 at 14:02 +0100, Daniel P. Berrangé wrote:
> > Blocking the 'fork' syscall on Linux is not sufficient to block the
> > 'fork' C library function, because the latter is essentially always
> > implemented using the 'clone' syscall these days.
> > 
> > Blocking 'clone' is difficult as that also blocks pthread creation,
> > so it needs careful filtering.
> > 
> > Daniel P. Berrangé (5):
> >   seccomp: allow action to be customized per syscall
> >   seccomp: add unit test for seccomp filtering
> >   seccomp: fix blocking of process spawning
> >   seccomp: block use of clone3 syscall
> >   seccomp: block setns, unshare and execveat syscalls
> > 
> >  MAINTAINERS               |   1 +
> >  softmmu/qemu-seccomp.c    | 282 +++++++++++++++++++++++++++++-------
> > --
> >  tests/unit/meson.build    |   4 +
> >  tests/unit/test-seccomp.c | 269 ++++++++++++++++++++++++++++++++++++
> >  4 files changed, 490 insertions(+), 66 deletions(-)
> >  create mode 100644 tests/unit/test-seccomp.c
> > 
> > -- 
> > 2.31.1
> > 
> > 
> 
> Acked-by: Eduardo Otubo <otubo@redhat.com>
> 
> -- 
> Eduardo Otubo
> 
> 



Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|