* [Qemu-devel] [PATCH] seccomp: add mbind() to the syscall whitelist
@ 2014-12-17 20:50 Paul Moore
2014-12-17 23:51 ` Eduardo Habkost
2014-12-18 8:27 ` Eduardo Otubo
0 siblings, 2 replies; 3+ messages in thread
From: Paul Moore @ 2014-12-17 20:50 UTC (permalink / raw)
To: qemu-devel, eduardo.otubo; +Cc: pbonzini
The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to
set the policy for a memory range. Add the syscall to the seccomp
sandbox whitelist.
Signed-off-by: Paul Moore <pmoore@redhat.com>
---
qemu-seccomp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index af6a375..b0c6269 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
{ SCMP_SYS(fallocate), 240 },
{ SCMP_SYS(fadvise64), 240 },
{ SCMP_SYS(inotify_init1), 240 },
- { SCMP_SYS(inotify_add_watch), 240 }
+ { SCMP_SYS(inotify_add_watch), 240 },
+ { SCMP_SYS(mbind), 240 }
};
int seccomp_start(void)
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] seccomp: add mbind() to the syscall whitelist
2014-12-17 20:50 [Qemu-devel] [PATCH] seccomp: add mbind() to the syscall whitelist Paul Moore
@ 2014-12-17 23:51 ` Eduardo Habkost
2014-12-18 8:27 ` Eduardo Otubo
1 sibling, 0 replies; 3+ messages in thread
From: Eduardo Habkost @ 2014-12-17 23:51 UTC (permalink / raw)
To: Paul Moore; +Cc: pbonzini, qemu-devel, eduardo.otubo
On Wed, Dec 17, 2014 at 03:50:09PM -0500, Paul Moore wrote:
> The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to
> set the policy for a memory range. Add the syscall to the seccomp
> sandbox whitelist.
>
> Signed-off-by: Paul Moore <pmoore@redhat.com>
Tested-by: Eduardo Habkost <ehabkost@redhat.com>
Reviewed-by: Eduardo Habkost <ehabkost@redhat.com>
> ---
> qemu-seccomp.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index af6a375..b0c6269 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> { SCMP_SYS(fallocate), 240 },
> { SCMP_SYS(fadvise64), 240 },
> { SCMP_SYS(inotify_init1), 240 },
> - { SCMP_SYS(inotify_add_watch), 240 }
> + { SCMP_SYS(inotify_add_watch), 240 },
> + { SCMP_SYS(mbind), 240 }
> };
>
> int seccomp_start(void)
>
>
--
Eduardo
^ permalink raw reply [flat|nested] 3+ messages in thread* Re: [Qemu-devel] [PATCH] seccomp: add mbind() to the syscall whitelist
2014-12-17 20:50 [Qemu-devel] [PATCH] seccomp: add mbind() to the syscall whitelist Paul Moore
2014-12-17 23:51 ` Eduardo Habkost
@ 2014-12-18 8:27 ` Eduardo Otubo
1 sibling, 0 replies; 3+ messages in thread
From: Eduardo Otubo @ 2014-12-18 8:27 UTC (permalink / raw)
To: Paul Moore; +Cc: pbonzini, qemu-devel
On Wed, Dec 17, 2014 at 03:50:09PM -0500, Paul Moore wrote:
> The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to
> set the policy for a memory range. Add the syscall to the seccomp
> sandbox whitelist.
>
> Signed-off-by: Paul Moore <pmoore@redhat.com>
> ---
> qemu-seccomp.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index af6a375..b0c6269 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> { SCMP_SYS(fallocate), 240 },
> { SCMP_SYS(fadvise64), 240 },
> { SCMP_SYS(inotify_init1), 240 },
> - { SCMP_SYS(inotify_add_watch), 240 }
> + { SCMP_SYS(inotify_add_watch), 240 },
> + { SCMP_SYS(mbind), 240 }
> };
>
> int seccomp_start(void)
>
Acked-by: Eduardo Otubo <eduardo.otubo@profitbricks.com>
I have a minor fix already in plan, so I'll do a pull request tomorrow
by the end of the day.
Thanks for the patch.
--
Eduardo Otubo
ProfitBricks GmbH
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2014-12-18 8:27 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-12-17 20:50 [Qemu-devel] [PATCH] seccomp: add mbind() to the syscall whitelist Paul Moore
2014-12-17 23:51 ` Eduardo Habkost
2014-12-18 8:27 ` Eduardo Otubo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).