From: namnamc@sigaint.org
To: qemu-devel@nongnu.org
Cc: armbru@redhat.com, eduardo.otubo@profitbricks.com
Subject: Re: [Qemu-devel] [PATCH] Add syscalls for -runas and -chroot to the seccomp sandbox
Date: Fri, 2 Oct 2015 00:17:53 -0000 [thread overview]
Message-ID: <facd5991586cc3ad1dc91aad3aa50673.webmail@localhost> (raw)
> Should it enable seccomp a bit later?
Ideally it should be enabled as late as possible, right before the main loop,
because here's no reason to whitelist syscalls that are only ever needed to
start QEMU up (e.g. chroot, which is only used before the guest even boots).
But for now, the simplest solution to the -chroot and -runas issue I can
think
of is to enable those syscalls in my patch.
next reply other threads:[~2015-10-02 0:18 UTC|newest]
Thread overview: 12+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-10-02 0:17 namnamc [this message]
-- strict thread matches above, loose matches on Subject: below --
2015-10-09 2:09 [Qemu-devel] [PATCH] Add syscalls for -runas and -chroot to the seccomp sandbox namnamc
2015-10-09 6:54 ` Markus Armbruster
2015-10-09 7:24 ` Eduardo Otubo
2015-10-01 4:36 Namsun Ch'o
2015-10-01 12:06 ` Markus Armbruster
2015-10-02 8:30 ` Daniel P. Berrange
2015-10-02 10:05 ` Markus Armbruster
2015-10-02 14:08 ` Eduardo Otubo
2015-10-02 14:15 ` Daniel P. Berrange
2015-10-02 15:36 ` Eduardo Otubo
2015-10-08 13:34 ` Eduardo Otubo
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=facd5991586cc3ad1dc91aad3aa50673.webmail@localhost \
--to=namnamc@sigaint.org \
--cc=armbru@redhat.com \
--cc=eduardo.otubo@profitbricks.com \
--cc=qemu-devel@nongnu.org \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).