From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:58957) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TQXT1-0005or-BT for qemu-devel@nongnu.org; Tue, 23 Oct 2012 01:55:56 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TQXT0-0002fz-2d for qemu-devel@nongnu.org; Tue, 23 Oct 2012 01:55:55 -0400 Received: from e24smtp03.br.ibm.com ([32.104.18.24]:47422) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TQXSz-0002fq-Mj for qemu-devel@nongnu.org; Tue, 23 Oct 2012 01:55:53 -0400 Received: from /spool/local by e24smtp03.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 23 Oct 2012 03:55:52 -0200 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id EC2543520054 for ; Tue, 23 Oct 2012 01:55:46 -0400 (EDT) Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q9N5tixf2252822 for ; Tue, 23 Oct 2012 03:55:44 -0200 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q9N5tkpB028152 for ; Tue, 23 Oct 2012 03:55:46 -0200 From: Eduardo Otubo Date: Tue, 23 Oct 2012 03:55:32 -0200 Message-Id: <1350971732-16621-4-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: <1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com> References: <1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCHv2 4/4] Warning messages on net devices hotplug List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, aliguori@us.ibm.com, coreyb@linux.vnet.ibm.com, Eduardo Otubo With the inclusion of the new "double whitelist" seccomp filter, Qemu won't be able to execve() in runtime, thus, no hotplug net devices allowed. v2: * Error messages moved to the backend function, net_init_tap(), recommended by Paolo Bonzini * Documentation added to QMP and HMP commands, and also to the Qemu options. Signed-off-by: Eduardo Otubo --- hmp-commands.hx | 4 ++-- net.c | 1 + net/tap.c | 5 +++++ qemu-options.hx | 3 ++- qmp-commands.hx | 3 ++- 5 files changed, 12 insertions(+), 4 deletions(-) diff --git a/hmp-commands.hx b/hmp-commands.hx index e0b537d..3e28501 100644 --- a/hmp-commands.hx +++ b/hmp-commands.hx @@ -1068,7 +1068,7 @@ ETEXI .name = "host_net_add", .args_type = "device:s,opts:s?", .params = "tap|user|socket|vde|dump [options]", - .help = "add host VLAN client", + .help = "add host VLAN client, feature disabled when -sandbox is in use", .mhandler.cmd = net_host_device_add, }, @@ -1096,7 +1096,7 @@ ETEXI .name = "netdev_add", .args_type = "netdev:O", .params = "[user|tap|socket],id=str[,prop=value][,...]", - .help = "add host network device", + .help = "add host network device, feature disabled when -sandbox is in use", .mhandler.cmd = hmp_netdev_add, }, diff --git a/net.c b/net.c index ae4bc0d..02188f0 100644 --- a/net.c +++ b/net.c @@ -765,6 +765,7 @@ void net_host_device_add(Monitor *mon, const QDict *qdict) qemu_opt_set(opts, "type", device); net_client_init(opts, 0, &local_err); + if (error_is_set(&local_err)) { qerror_report_err(local_err); error_free(local_err); diff --git a/net/tap.c b/net/tap.c index df89caa..dd8c79b 100644 --- a/net/tap.c +++ b/net/tap.c @@ -590,6 +590,11 @@ static int net_tap_init(const NetdevTapOptions *tap, int *vnet_hdr, int net_init_tap(const NetClientOptions *opts, const char *name, NetClientState *peer) { +#ifdef CONFIG_SECCOMP + error_report("Cannot hotplug TAP device when -sandbox is in effect"); + return -1; +#endif + const NetdevTapOptions *tap; int fd, vnet_hdr = 0; diff --git a/qemu-options.hx b/qemu-options.hx index 7d97f96..02afba3 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2767,7 +2767,8 @@ STEXI @item -sandbox @findex -sandbox Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will -disable it. The default is 'off'. +disable it. The default is 'on'. Note that when using the '-sandbox on' option the hot plug +of new devices will be disabled. ETEXI DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig, diff --git a/qmp-commands.hx b/qmp-commands.hx index 2f8477e..cccb8f1 100644 --- a/qmp-commands.hx +++ b/qmp-commands.hx @@ -757,7 +757,8 @@ Example: Note: The supported device options are the same ones supported by the '-net' command-line argument, which are listed in the '-help' output or QEMU's - manual + manual. Also note that the hot plug is disabled when -sandbox is in + effect EQMP -- 1.7.12