From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:41965) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Vo8w3-0006mB-C9 for qemu-devel@nongnu.org; Wed, 04 Dec 2013 04:40:07 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Vo8vu-0002Mh-9F for qemu-devel@nongnu.org; Wed, 04 Dec 2013 04:39:59 -0500 Received: from mail-ee0-x22b.google.com ([2a00:1450:4013:c00::22b]:42246) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Vo8vu-0002MY-2D for qemu-devel@nongnu.org; Wed, 04 Dec 2013 04:39:50 -0500 Received: by mail-ee0-f43.google.com with SMTP id c13so2199813eek.30 for ; Wed, 04 Dec 2013 01:39:49 -0800 (PST) Date: Wed, 4 Dec 2013 10:39:46 +0100 From: Stefan Hajnoczi Message-ID: <20131204093946.GA19096@stefanha-thinkpad.redhat.com> References: <1382440906-3852-1-git-send-email-otubo@linux.vnet.ibm.com> <3468561.4aYf2ZG3eq@sifl> <20131122154841.GA3232@stefanha-thinkpad.redhat.com> <7966284.CJrPIyrYnI@sifl> MIME-Version: 1.0 Content-Type: text/plain; charset=us-ascii Content-Disposition: inline In-Reply-To: <7966284.CJrPIyrYnI@sifl> Subject: Re: [Qemu-devel] [PATCH for-1.7] seccomp: setting "-sandbox on" by default List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Moore Cc: Paolo Bonzini , coreyb@linux.vnet.ibm.com, qemu-devel , Anthony Liguori , Eduardo Otubo On Fri, Nov 22, 2013 at 11:00:24AM -0500, Paul Moore wrote: > > Developers will only be happy with seccomp if it's easy and rewarding to > > support/debug. > > Agreed. > > As a developer, how do you feel about the audit/syslog based approach I > mentioned earlier? I used the commands you posted (I think that's what you mean). They produce useful output. The problem is that without an error message on stderr or from the shell, no one will think "QEMU process dead and hung == check seccomp" immediately. It's frustrating to deal with a "silent" failure. Stefan