From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:60318) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1V9GGo-0005OW-7J for qemu-devel@nongnu.org; Tue, 13 Aug 2013 11:12:37 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1V9GGd-0003y5-LZ for qemu-devel@nongnu.org; Tue, 13 Aug 2013 11:12:26 -0400 Sender: fluxion From: Michael Roth Date: Tue, 13 Aug 2013 10:10:50 -0500 Message-Id: <1376406680-16302-27-git-send-email-mdroth@linux.vnet.ibm.com> In-Reply-To: <1376406680-16302-1-git-send-email-mdroth@linux.vnet.ibm.com> References: <1376406680-16302-1-git-send-email-mdroth@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH 26/56] seccomp: add the asynchronous I/O syscalls to the whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: aliguori@us.ibm.com, qemu-stable@nongnu.org From: Paul Moore In order to enable the asynchronous I/O functionality when using the seccomp sandbox we need to add the associated syscalls to the whitelist. Signed-off-by: Paul Moore Reviewed-by: Corey Bryant Message-id: 20130529203001.20939.83322.stgit@localhost Signed-off-by: Anthony Liguori (cherry picked from commit fd21faadb12669e24eaf0a277de61c24fcde4cac) Signed-off-by: Michael Roth --- qemu-seccomp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 031da1d..ca123bf 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -87,6 +87,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(stat), 245 }, { SCMP_SYS(uname), 245 }, { SCMP_SYS(eventfd2), 245 }, + { SCMP_SYS(io_getevents), 245 }, { SCMP_SYS(dup), 245 }, { SCMP_SYS(dup2), 245 }, { SCMP_SYS(dup3), 245 }, @@ -229,7 +230,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(sendmmsg), 241 }, { SCMP_SYS(recvmmsg), 241 }, { SCMP_SYS(prlimit64), 241 }, - { SCMP_SYS(waitid), 241 } + { SCMP_SYS(waitid), 241 }, + { SCMP_SYS(io_setup), 241 }, + { SCMP_SYS(io_destroy), 241 } }; int seccomp_start(void) -- 1.7.9.5