From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:36796) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TGxwE-0006xK-7J for qemu-devel@nongnu.org; Wed, 26 Sep 2012 16:10:31 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TGxwD-0001RT-2p for qemu-devel@nongnu.org; Wed, 26 Sep 2012 16:10:30 -0400 Received: from mx1.redhat.com ([209.132.183.28]:14758) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TGxwC-0001QL-QE for qemu-devel@nongnu.org; Wed, 26 Sep 2012 16:10:28 -0400 From: Paul Moore Date: Wed, 26 Sep 2012 16:10:01 -0400 Message-ID: <2382564.6AYpmYLdf3@sifl> In-Reply-To: <1348231233-29841-1-git-send-email-otubo@linux.vnet.ibm.com> References: <505C4DA3.8020009@redhat.com> <1348231233-29841-1-git-send-email-otubo@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Type: multipart/mixed; boundary="nextPart35495769.UWGtBqUoaq" Content-Transfer-Encoding: 7Bit Subject: Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo Cc: qemu-devel@nongnu.org This is a multi-part message in MIME format. --nextPart35495769.UWGtBqUoaq Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" On Friday, September 21, 2012 09:40:33 AM Eduardo Otubo wrote: > Seccomp syscall whitelist updated after tests running qemu under > libvirt. Reference to the bug - > https://bugzilla.redhat.com/show_bug.cgi?id=855162 Unfortunately, this patch still does not work correctly for me using F17/libvirt and a F16 guest. The QEMU instance starts, and the guest appears to be running, but I never see any of the BIOS POST messages on the console. I'm attaching the guest's XML definition file if that helps. > Signed-off-by: Eduardo Otubo > --- > qemu-seccomp.c | 21 ++++++++++++++++++++- > 1 file changed, 20 insertions(+), 1 deletion(-) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 64329a3..4712338 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] > = { { SCMP_SYS(setsockopt), 245}, > { SCMP_SYS(uname), 245}, > { SCMP_SYS(semget), 245}, > + { SCMP_SYS(accept4), 241 }, > #endif > { SCMP_SYS(eventfd2), 245 }, > { SCMP_SYS(dup), 245 }, > @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall > seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, > { SCMP_SYS(getpeername), 242 }, > { SCMP_SYS(fdatasync), 242 }, > - { SCMP_SYS(close), 242 } > + { SCMP_SYS(close), 242 }, > + { SCMP_SYS(unlink), 241 }, > + { SCMP_SYS(statfs), 241 }, > + { SCMP_SYS(getuid), 241 }, > + { SCMP_SYS(ftruncate), 241 }, > + { SCMP_SYS(getegid), 241 }, > + { SCMP_SYS(geteuid), 241 }, > + { SCMP_SYS(getgid), 241 }, > + { SCMP_SYS(getrlimit), 241 }, > + { SCMP_SYS(set_tid_address), 241 }, > + { SCMP_SYS(socketpair), 241 }, > + { SCMP_SYS(fstatfs), 241 }, > + { SCMP_SYS(epoll_create), 241 }, > + { SCMP_SYS(epoll_ctl), 241 }, > + { SCMP_SYS(epoll_wait), 241 }, > + { SCMP_SYS(pipe), 241 }, > + { SCMP_SYS(poll), 241 }, > + { SCMP_SYS(rt_sigpending), 241 }, > + { SCMP_SYS(rt_sigtimedwait), 241 }, > }; > > int seccomp_start(void) -- paul moore security and virtualization @ redhat --nextPart35495769.UWGtBqUoaq Content-Disposition: attachment; filename="f16-test-1.xml" Content-Transfer-Encoding: 7Bit Content-Type: application/xml; name="f16-test-1.xml" f16-test-1 13c7da9b-a79a-0688-267a-8206136bc8d6 2097152 2097152 2 hvm destroy restart restart /usr/bin/qemu-kvm