From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([208.118.235.92]:55350)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1TfuM7-0008Tg-E7
	for qemu-devel@nongnu.org; Tue, 04 Dec 2012 10:24:25 -0500
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1TfuLx-0006GL-HD
	for qemu-devel@nongnu.org; Tue, 04 Dec 2012 10:24:19 -0500
Received: from mx1.redhat.com ([209.132.183.28]:18728)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1TfuLx-0006G9-9u
	for qemu-devel@nongnu.org; Tue, 04 Dec 2012 10:24:09 -0500
Date: Tue, 4 Dec 2012 15:23:56 +0000
From: "Daniel P. Berrange" <berrange@redhat.com>
Message-ID: <20121204152356.GL8233@redhat.com>
References: <50BCCB77.1080404@redhat.com>
	<20121204094628.1518b973@doriath.home>
	<50BE0BD8.2010501@redhat.com>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <50BE0BD8.2010501@redhat.com>
Content-Transfer-Encoding: quoted-printable
Subject: Re: [Qemu-devel] detecting seccomp sandbox capability via QMP
Reply-To: "Daniel P. Berrange" <berrange@redhat.com>
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: =?utf-8?Q?J=C3=A1n?= Tomko <jtomko@redhat.com>
Cc: otubo@linux.vnet.ibm.com, qemu-devel@nongnu.org, Luiz Capitulino <lcapitulino@redhat.com>

On Tue, Dec 04, 2012 at 03:42:32PM +0100, J=C3=A1n Tomko wrote:
> On 12/04/12 12:46, Luiz Capitulino wrote:
> > On Mon, 03 Dec 2012 16:55:35 +0100
> > J=C3=A1n Tomko <jtomko@redhat.com> wrote:
> >=20
> >> Hello,
> >>
> >> is there a way to check if QEMU was compiled with --enable-seccomp v=
ia QMP?
> >=20
> > Not that I'm aware of. Could you describe your use-case?
>=20
> It's for libvirt. The detection is broken since the switch from parsing
> -help output to QMP and I wanted to fix it.
>=20
> Assuming it's supported if we do capabilities detection via QMP (since
> libvirt 1.0.0 and QEMU 1.2) would work except for this case:
> If seccomp sandbox was requested in /etc/libvirt/qemu.conf, but it was
> compiled out from qemu, libvirt would try to run QEMU with -sandbox on
> instead of printing an error earlier.

In the absence of any way to detect it via QMP, libvirt should fallback
to hardcoding it based on the version number. This presumes that QEMU was
built with it enabled in configure, but we've no other option for current
released 1.2/1.3 versions.

Daniel
--=20
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange=
/ :|
|: http://libvirt.org              -o-             http://virt-manager.or=
g :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr=
/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vn=
c :|