From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:36308) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TF2XJ-0006fc-LO for qemu-devel@nongnu.org; Fri, 21 Sep 2012 08:40:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TF2XD-0008H5-Qr for qemu-devel@nongnu.org; Fri, 21 Sep 2012 08:40:49 -0400 Received: from e24smtp05.br.ibm.com ([32.104.18.26]:51585) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TF2XD-0008Gq-Cc for qemu-devel@nongnu.org; Fri, 21 Sep 2012 08:40:43 -0400 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 21 Sep 2012 09:40:39 -0300 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 4F28E352001A for ; Fri, 21 Sep 2012 08:40:36 -0400 (EDT) Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q8LCeWL31253538 for ; Fri, 21 Sep 2012 09:40:32 -0300 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q8LCeZKP011152 for ; Fri, 21 Sep 2012 09:40:35 -0300 From: Eduardo Otubo Date: Fri, 21 Sep 2012 09:40:33 -0300 Message-Id: <1348231233-29841-1-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: <505C4DA3.8020009@redhat.com> References: <505C4DA3.8020009@redhat.com> Subject: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: Eduardo Otubo Seccomp syscall whitelist updated after tests running qemu under libvirt. Reference to the bug - https://bugzilla.redhat.com/show_bug.cgi?id=855162 Signed-off-by: Eduardo Otubo --- qemu-seccomp.c | 21 ++++++++++++++++++++- 1 file changed, 20 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 64329a3..4712338 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(setsockopt), 245}, { SCMP_SYS(uname), 245}, { SCMP_SYS(semget), 245}, + { SCMP_SYS(accept4), 241 }, #endif { SCMP_SYS(eventfd2), 245 }, { SCMP_SYS(dup), 245 }, @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, { SCMP_SYS(getpeername), 242 }, { SCMP_SYS(fdatasync), 242 }, - { SCMP_SYS(close), 242 } + { SCMP_SYS(close), 242 }, + { SCMP_SYS(unlink), 241 }, + { SCMP_SYS(statfs), 241 }, + { SCMP_SYS(getuid), 241 }, + { SCMP_SYS(ftruncate), 241 }, + { SCMP_SYS(getegid), 241 }, + { SCMP_SYS(geteuid), 241 }, + { SCMP_SYS(getgid), 241 }, + { SCMP_SYS(getrlimit), 241 }, + { SCMP_SYS(set_tid_address), 241 }, + { SCMP_SYS(socketpair), 241 }, + { SCMP_SYS(fstatfs), 241 }, + { SCMP_SYS(epoll_create), 241 }, + { SCMP_SYS(epoll_ctl), 241 }, + { SCMP_SYS(epoll_wait), 241 }, + { SCMP_SYS(pipe), 241 }, + { SCMP_SYS(poll), 241 }, + { SCMP_SYS(rt_sigpending), 241 }, + { SCMP_SYS(rt_sigtimedwait), 241 }, }; int seccomp_start(void) -- 1.7.12