From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:42071) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TG7uc-0004Mv-It for qemu-devel@nongnu.org; Mon, 24 Sep 2012 08:37:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TG7uY-0007Bb-9z for qemu-devel@nongnu.org; Mon, 24 Sep 2012 08:37:22 -0400 Received: from e24smtp01.br.ibm.com ([32.104.18.85]:56625) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TG7uX-00078T-Ug for qemu-devel@nongnu.org; Mon, 24 Sep 2012 08:37:18 -0400 Received: from /spool/local by e24smtp01.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 24 Sep 2012 09:36:49 -0300 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 2A1DC352001B for ; Mon, 24 Sep 2012 08:36:47 -0400 (EDT) Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q8OCaeAQ1245352 for ; Mon, 24 Sep 2012 09:36:41 -0300 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q8OCakS3014552 for ; Mon, 24 Sep 2012 09:36:46 -0300 Received: from bluepex.com (dhcp-9-18-235-70.br.ibm.com [9.18.235.70]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with SMTP id q8OCajZ6014530 for ; Mon, 24 Sep 2012 09:36:45 -0300 Date: Mon, 24 Sep 2012 09:36:47 -0300 From: Eduardo Otubo Message-ID: <20120924123647.GA28312@bluepex.com> References: <505C4DA3.8020009@redhat.com> <1348231233-29841-1-git-send-email-otubo@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: <1348231233-29841-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Anyone interested in taking a look at this piece of code? Thanks! On Fri, Sep 21, 2012 at 09:40:33AM -0300, Eduardo Otubo wrote: > Seccomp syscall whitelist updated after tests running qemu under > libvirt. Reference to the bug - > https://bugzilla.redhat.com/show_bug.cgi?id=855162 > > Signed-off-by: Eduardo Otubo > --- > qemu-seccomp.c | 21 ++++++++++++++++++++- > 1 file changed, 20 insertions(+), 1 deletion(-) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 64329a3..4712338 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > { SCMP_SYS(setsockopt), 245}, > { SCMP_SYS(uname), 245}, > { SCMP_SYS(semget), 245}, > + { SCMP_SYS(accept4), 241 }, > #endif > { SCMP_SYS(eventfd2), 245 }, > { SCMP_SYS(dup), 245 }, > @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > { SCMP_SYS(getsockname), 242 }, > { SCMP_SYS(getpeername), 242 }, > { SCMP_SYS(fdatasync), 242 }, > - { SCMP_SYS(close), 242 } > + { SCMP_SYS(close), 242 }, > + { SCMP_SYS(unlink), 241 }, > + { SCMP_SYS(statfs), 241 }, > + { SCMP_SYS(getuid), 241 }, > + { SCMP_SYS(ftruncate), 241 }, > + { SCMP_SYS(getegid), 241 }, > + { SCMP_SYS(geteuid), 241 }, > + { SCMP_SYS(getgid), 241 }, > + { SCMP_SYS(getrlimit), 241 }, > + { SCMP_SYS(set_tid_address), 241 }, > + { SCMP_SYS(socketpair), 241 }, > + { SCMP_SYS(fstatfs), 241 }, > + { SCMP_SYS(epoll_create), 241 }, > + { SCMP_SYS(epoll_ctl), 241 }, > + { SCMP_SYS(epoll_wait), 241 }, > + { SCMP_SYS(pipe), 241 }, > + { SCMP_SYS(poll), 241 }, > + { SCMP_SYS(rt_sigpending), 241 }, > + { SCMP_SYS(rt_sigtimedwait), 241 }, > }; > > int seccomp_start(void) > -- > 1.7.12 > -- Eduardo Otubo Software Engineer Linux Technology Center IBM Systems & Technology Group