From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:33704) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UXYzN-0005op-NP for qemu-devel@nongnu.org; Wed, 01 May 2013 11:30:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1UXYzL-0005CP-Qs for qemu-devel@nongnu.org; Wed, 01 May 2013 11:30:37 -0400 Received: from e8.ny.us.ibm.com ([32.97.182.138]:47643) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1UXYzL-0004zX-LG for qemu-devel@nongnu.org; Wed, 01 May 2013 11:30:35 -0400 Received: from /spool/local by e8.ny.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 1 May 2013 11:30:03 -0400 Received: from d01relay03.pok.ibm.com (d01relay03.pok.ibm.com [9.56.227.235]) by d01dlp01.pok.ibm.com (Postfix) with ESMTP id 388EE38C8045 for ; Wed, 1 May 2013 11:30:01 -0400 (EDT) Received: from d01av05.pok.ibm.com (d01av05.pok.ibm.com [9.56.224.195]) by d01relay03.pok.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r41FU1oQ173060 for ; Wed, 1 May 2013 11:30:01 -0400 Received: from d01av05.pok.ibm.com (loopback [127.0.0.1]) by d01av05.pok.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id r41FU0gE004988 for ; Wed, 1 May 2013 11:30:01 -0400 Message-ID: <518134F8.3020506@linux.vnet.ibm.com> Date: Wed, 01 May 2013 11:30:00 -0400 From: Corey Bryant MIME-Version: 1.0 References: <517AC9E5.3050204@linux.vnet.ibm.com> <518011C8.7050200@linux.vnet.ibm.com> <51802986.3070701@linux.vnet.ibm.com> <11691265.oTT9LbASug@sifl> In-Reply-To: <11691265.oTT9LbASug@sifl> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [RFC] Continuous work on sandboxing List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Moore Cc: qemu-devel@nongnu.org, Eric Paris , Eduardo Otubo On 05/01/2013 10:13 AM, Paul Moore wrote: > On Tuesday, April 30, 2013 04:28:54 PM Corey Bryant wrote: >> Just to be clear, I'm thinking you could launch guests in one of two >> different seccomp sandboxed environments: >> >> 1) Using the existing and more permissive whitelist where every QEMU >> feature works: >> >> qemu-kvm -sandbox on,default > > In general, I like the comma delimited list of sandbox filters/methods/etc. > but I'm not sure we need to explicitly specify "default", it seems like "on" > would be sufficient. It also preserved compatibility with what we have now. > Yes, I agree. This should definitely remain backward compatible. -- Regards, Corey Bryant