* [PATCH] seccomp: fix killing of whole process instead of thread
@ 2020-09-11 14:18 Daniel P. Berrangé
2020-09-14 10:19 ` Stefan Hajnoczi
2020-09-15 10:22 ` Eduardo Otubo
0 siblings, 2 replies; 3+ messages in thread
From: Daniel P. Berrangé @ 2020-09-11 14:18 UTC (permalink / raw)
To: qemu-devel; +Cc: Eduardo Otubo, Daniel P. Berrangé
Back in 2018 we introduced support for killing the whole QEMU process
instead of just one thread, when a seccomp rule is violated:
commit bda08a5764d470f101fa38635d30b41179a313e1
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: Wed Aug 22 19:02:48 2018 +0200
seccomp: prefer SCMP_ACT_KILL_PROCESS if available
Fast forward a year and we introduced a patch to avoid killing the
process for resource control syscalls tickled by Mesa.
commit 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8
Author: Daniel P. Berrangé <berrange@redhat.com>
Date: Wed Mar 13 09:49:03 2019 +0000
seccomp: don't kill process for resource control syscalls
Unfortunately a logic bug effectively reverted the first commit
mentioned so that we go back to only killing the thread, not the whole
process.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
qemu-seccomp.c | 3 ++-
1 file changed, 2 insertions(+), 1 deletion(-)
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index e0a1829b3d..8325ecb766 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -136,8 +136,9 @@ static uint32_t qemu_seccomp_get_action(int set)
if (qemu_seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0) {
kill_process = 1;
+ } else {
+ kill_process = 0;
}
- kill_process = 0;
}
if (kill_process == 1) {
return SCMP_ACT_KILL_PROCESS;
--
2.26.2
^ permalink raw reply related [flat|nested] 3+ messages in thread* Re: [PATCH] seccomp: fix killing of whole process instead of thread
2020-09-11 14:18 [PATCH] seccomp: fix killing of whole process instead of thread Daniel P. Berrangé
@ 2020-09-14 10:19 ` Stefan Hajnoczi
2020-09-15 10:22 ` Eduardo Otubo
1 sibling, 0 replies; 3+ messages in thread
From: Stefan Hajnoczi @ 2020-09-14 10:19 UTC (permalink / raw)
To: Daniel P. Berrangé; +Cc: Eduardo Otubo, qemu-devel
[-- Attachment #1: Type: text/plain, Size: 1145 bytes --]
On Fri, Sep 11, 2020 at 03:18:32PM +0100, Daniel P. Berrangé wrote:
> Back in 2018 we introduced support for killing the whole QEMU process
> instead of just one thread, when a seccomp rule is violated:
>
> commit bda08a5764d470f101fa38635d30b41179a313e1
> Author: Marc-André Lureau <marcandre.lureau@redhat.com>
> Date: Wed Aug 22 19:02:48 2018 +0200
>
> seccomp: prefer SCMP_ACT_KILL_PROCESS if available
>
> Fast forward a year and we introduced a patch to avoid killing the
> process for resource control syscalls tickled by Mesa.
>
> commit 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8
> Author: Daniel P. Berrangé <berrange@redhat.com>
> Date: Wed Mar 13 09:49:03 2019 +0000
>
> seccomp: don't kill process for resource control syscalls
>
> Unfortunately a logic bug effectively reverted the first commit
> mentioned so that we go back to only killing the thread, not the whole
> process.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
> qemu-seccomp.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
* Re: [PATCH] seccomp: fix killing of whole process instead of thread
2020-09-11 14:18 [PATCH] seccomp: fix killing of whole process instead of thread Daniel P. Berrangé
2020-09-14 10:19 ` Stefan Hajnoczi
@ 2020-09-15 10:22 ` Eduardo Otubo
1 sibling, 0 replies; 3+ messages in thread
From: Eduardo Otubo @ 2020-09-15 10:22 UTC (permalink / raw)
To: Daniel P. Berrangé; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 1690 bytes --]
On 11/09/2020 - 15:18:32, Daniel P. Berrange wrote:
> Back in 2018 we introduced support for killing the whole QEMU process
> instead of just one thread, when a seccomp rule is violated:
>
> commit bda08a5764d470f101fa38635d30b41179a313e1
> Author: Marc-André Lureau <marcandre.lureau@redhat.com>
> Date: Wed Aug 22 19:02:48 2018 +0200
>
> seccomp: prefer SCMP_ACT_KILL_PROCESS if available
>
> Fast forward a year and we introduced a patch to avoid killing the
> process for resource control syscalls tickled by Mesa.
>
> commit 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8
> Author: Daniel P. Berrangé <berrange@redhat.com>
> Date: Wed Mar 13 09:49:03 2019 +0000
>
> seccomp: don't kill process for resource control syscalls
>
> Unfortunately a logic bug effectively reverted the first commit
> mentioned so that we go back to only killing the thread, not the whole
> process.
>
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
> ---
> qemu-seccomp.c | 3 ++-
> 1 file changed, 2 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index e0a1829b3d..8325ecb766 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -136,8 +136,9 @@ static uint32_t qemu_seccomp_get_action(int set)
>
> if (qemu_seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0) {
> kill_process = 1;
> + } else {
> + kill_process = 0;
> }
> - kill_process = 0;
> }
> if (kill_process == 1) {
> return SCMP_ACT_KILL_PROCESS;
> --
> 2.26.2
>
Acked-by: Eduardo Otubo <otubo@redhat.com>
[-- Attachment #2: signature.asc --]
[-- Type: application/pgp-signature, Size: 488 bytes --]
^ permalink raw reply [flat|nested] 3+ messages in thread
end of thread, other threads:[~2020-09-15 13:18 UTC | newest]
Thread overview: 3+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2020-09-11 14:18 [PATCH] seccomp: fix killing of whole process instead of thread Daniel P. Berrangé
2020-09-14 10:19 ` Stefan Hajnoczi
2020-09-15 10:22 ` Eduardo Otubo
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).