From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:51066) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VbSds-0005HW-Ey for qemu-devel@nongnu.org; Wed, 30 Oct 2013 06:04:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VbSdn-0007fH-1h for qemu-devel@nongnu.org; Wed, 30 Oct 2013 06:04:48 -0400 Received: from mail-ea0-x22d.google.com ([2a00:1450:4013:c01::22d]:63802) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VbSdm-0007e0-QL for qemu-devel@nongnu.org; Wed, 30 Oct 2013 06:04:42 -0400 Received: by mail-ea0-f173.google.com with SMTP id g10so525089eak.18 for ; Wed, 30 Oct 2013 03:04:41 -0700 (PDT) Date: Wed, 30 Oct 2013 11:04:39 +0100 From: Stefan Hajnoczi Message-ID: <20131030100439.GD11994@stefanha-thinkpad.redhat.com> References: <1382440906-3852-1-git-send-email-otubo@linux.vnet.ibm.com> <5267E05A.1010601@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <5267E05A.1010601@linux.vnet.ibm.com> Subject: Re: [Qemu-devel] [PATCH for-1.7] seccomp: setting "-sandbox on" by default List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo Cc: Paul Moore , coreyb@linux.vnet.ibm.com, qemu-devel , Anthony Liguori On Wed, Oct 23, 2013 at 12:42:34PM -0200, Eduardo Otubo wrote: > > > On 10/22/2013 11:00 AM, Anthony Liguori wrote: > >On Tue, Oct 22, 2013 at 12:21 PM, Eduardo Otubo > > wrote: > >>Inverting the way sandbox handles arguments, making possible to have no > >>argument and still have '-sandbox on' enabled. > >> > >>Signed-off-by: Eduardo Otubo > >>--- > >> > >>The option '-sandbox on' is now used by default by virt-test[0] -- it has been > >>merged into the 'next' branch and will be available in the next release, > >>meaning we have a back support for regression tests if anything breaks because > >>of some missing system call not listed in the whitelist. > >> > >>This being said, I think it makes sense to have this option set to 'on' by > >>default in the next Qemu version. It's been a while since no missing syscall is > >>reported and at this point the whitelist seems to be pretty mature. > >> > >>[0] - https://github.com/autotest/virt-test/commit/50e1f7d47a94f4c770880cd8ec0f18365dcba714 > > > >This breaks hot_add of a network device that uses a script= argument, correct? > > > >If so, this cannot be made default. > > Anthony, I believe you're talking about the blacklist feature. This > is the old whitelist that is already upstream and it does not block > any network device to be hot plugged. The following fails to start here (the shell hangs and ps shows QEMU is a process): qemu-system-x86_64 -sandbox on -enable-kvm -m 1024 -cpu host \ -drive if=virtio,cache=none,file=test.img It is using the GTK UI. Stefan