From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:43821) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TOTTd-0004sa-Q5 for qemu-devel@nongnu.org; Wed, 17 Oct 2012 09:16:12 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TOTTX-0002WV-K4 for qemu-devel@nongnu.org; Wed, 17 Oct 2012 09:16:01 -0400 Received: from e24smtp02.br.ibm.com ([32.104.18.86]:54210) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TOTTX-0002SI-8V for qemu-devel@nongnu.org; Wed, 17 Oct 2012 09:15:55 -0400 Received: from /spool/local by e24smtp02.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 17 Oct 2012 10:15:52 -0300 Received: from d24relay03.br.ibm.com (d24relay03.br.ibm.com [9.13.184.25]) by d24dlp02.br.ibm.com (Postfix) with ESMTP id 673801DC0057 for ; Wed, 17 Oct 2012 09:15:46 -0400 (EDT) Received: from d24av05.br.ibm.com (d24av05.br.ibm.com [9.18.232.44]) by d24relay03.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q9HDEXKl19857552 for ; Wed, 17 Oct 2012 10:14:33 -0300 Received: from d24av05.br.ibm.com (loopback [127.0.0.1]) by d24av05.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q9HDFjet008861 for ; Wed, 17 Oct 2012 10:15:45 -0300 From: Eduardo Otubo Date: Wed, 17 Oct 2012 10:15:10 -0300 Message-Id: <1350479712-15082-2-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: <1350479712-15082-1-git-send-email-otubo@linux.vnet.ibm.com> References: <1350479712-15082-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 2/4] Setting "-sandbox on" as deafult List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, aliguori@us.ibm.com, coreyb@linux.vnet.ibm.com, Eduardo Otubo Now the seccomp filter will be set to "on" even if no argument "-sandbox" is given. Signed-off-by: Eduardo Otubo --- configure | 2 +- vl.c | 38 +++++++++++++++++++++++++++----------- 2 files changed, 28 insertions(+), 12 deletions(-) diff --git a/configure b/configure index 353d788..c613a51 100755 --- a/configure +++ b/configure @@ -220,7 +220,7 @@ guest_agent="yes" want_tools="yes" libiscsi="" coroutine="" -seccomp="" +seccomp="yes" glusterfs="" # parse CC options first diff --git a/vl.c b/vl.c index 5b357a3..bec68cd 100644 --- a/vl.c +++ b/vl.c @@ -276,6 +276,10 @@ static int default_cdrom = 1; static int default_sdcard = 1; static int default_vga = 1; +#ifdef CONFIG_SECCOMP +bool seccomp_on = true; +#endif + static struct { const char *driver; int *flag; @@ -770,23 +774,28 @@ static int bt_parse(const char *opt) return 1; } -static int parse_sandbox(QemuOpts *opts, void *opaque) +static int install_seccomp_filters(void) { - /* FIXME: change this to true for 1.3 */ - if (qemu_opt_get_bool(opts, "enable", false)) { #ifdef CONFIG_SECCOMP - if (seccomp_start() < 0) { - qerror_report(ERROR_CLASS_GENERIC_ERROR, - "failed to install seccomp syscall filter in the kernel"); - return -1; - } -#else + if (seccomp_start() < 0) { qerror_report(ERROR_CLASS_GENERIC_ERROR, - "sandboxing request but seccomp is not compiled into this build"); + "failed to install seccomp syscall filter in the kernel"); return -1; -#endif } +#else + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "sandboxing requested but seccomp is not compiled into this build"); + return -1; +#endif + return 0; +} + +static int parse_sandbox(QemuOpts *opts, void *opaque) +{ + if (!qemu_opt_get_bool(opts, "enable", true)) { + seccomp_on = false; + } return 0; } @@ -3320,6 +3329,13 @@ int main(int argc, char **argv, char **envp) exit(1); } + /* We should install seccomp filters even if -sandbox on is not used. */ + if (seccomp_on) { + if (install_seccomp_filters() < 0) { + exit(1); + } + } + if (machine == NULL) { fprintf(stderr, "No machine found.\n"); exit(1); -- 1.7.12