From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:49477) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TEnsE-0004aN-3U for qemu-devel@nongnu.org; Thu, 20 Sep 2012 17:01:27 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TEnsC-0005b2-V4 for qemu-devel@nongnu.org; Thu, 20 Sep 2012 17:01:26 -0400 Received: from e24smtp04.br.ibm.com ([32.104.18.25]:41797) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TEnsC-0005Yt-Jr for qemu-devel@nongnu.org; Thu, 20 Sep 2012 17:01:24 -0400 Received: from /spool/local by e24smtp04.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Thu, 20 Sep 2012 18:01:20 -0300 Received: from d24relay03.br.ibm.com (d24relay03.br.ibm.com [9.13.184.25]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 71C50352001D for ; Thu, 20 Sep 2012 17:01:16 -0400 (EDT) Received: from d24av05.br.ibm.com (d24av05.br.ibm.com [9.18.232.44]) by d24relay03.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q8KL0BrD48693324 for ; Thu, 20 Sep 2012 18:00:11 -0300 Received: from d24av05.br.ibm.com (loopback [127.0.0.1]) by d24av05.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q8KL1FHO027946 for ; Thu, 20 Sep 2012 18:01:15 -0300 From: Eduardo Otubo Date: Thu, 20 Sep 2012 18:00:59 -0300 Message-Id: <1348174859-24809-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Eduardo Otubo Seccomp syscall whitelist updated after tests running qemu under libvirt. Reference to the bug - https://bugzilla.redhat.com/show_bug.cgi?id=855162 Regards, --- qemu-seccomp.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 64329a3..4712338 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(setsockopt), 245}, { SCMP_SYS(uname), 245}, { SCMP_SYS(semget), 245}, + { SCMP_SYS(accept4), 241 }, #endif { SCMP_SYS(eventfd2), 245 }, { SCMP_SYS(dup), 245 }, @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, { SCMP_SYS(getpeername), 242 }, { SCMP_SYS(fdatasync), 242 }, - { SCMP_SYS(close), 242 } + { SCMP_SYS(close), 242 }, + { SCMP_SYS(unlink), 241 }, + { SCMP_SYS(statfs), 241 }, + { SCMP_SYS(getuid), 241 }, + { SCMP_SYS(ftruncate), 241 }, + { SCMP_SYS(getegid), 241 }, + { SCMP_SYS(geteuid), 241 }, + { SCMP_SYS(getgid), 241 }, + { SCMP_SYS(getrlimit), 241 }, + { SCMP_SYS(set_tid_address), 241 }, + { SCMP_SYS(socketpair), 241 }, + { SCMP_SYS(fstatfs), 241 }, + { SCMP_SYS(epoll_create), 241 }, + { SCMP_SYS(epoll_ctl), 241 }, + { SCMP_SYS(epoll_wait), 241 }, + { SCMP_SYS(pipe), 241 }, + { SCMP_SYS(poll), 241 }, + { SCMP_SYS(rt_sigpending), 241 }, + { SCMP_SYS(rt_sigtimedwait), 241 }, }; int seccomp_start(void) -- 1.7.12