From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:51063)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <namnamc@sigaint.org>) id 1Zho32-0004PD-Rt
	for qemu-devel@nongnu.org; Thu, 01 Oct 2015 20:18:05 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <namnamc@sigaint.org>) id 1Zho2z-0005pN-MG
	for qemu-devel@nongnu.org; Thu, 01 Oct 2015 20:18:04 -0400
Received: from mx2.sigaint.org ([62.113.238.120]:58322 helo=mx1.sigaint.org)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <namnamc@sigaint.org>) id 1Zho2x-0005nm-P2
	for qemu-devel@nongnu.org; Thu, 01 Oct 2015 20:18:01 -0400
Message-ID: <facd5991586cc3ad1dc91aad3aa50673.webmail@localhost>
Date: Fri, 2 Oct 2015 00:17:53 -0000
From: namnamc@sigaint.org
MIME-Version: 1.0
Content-Type: text/plain;charset=iso-8859-1
Content-Transfer-Encoding: 8bit
Subject: Re: [Qemu-devel] [PATCH] Add syscalls for -runas and -chroot to the
 seccomp sandbox
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: qemu-devel@nongnu.org
Cc: armbru@redhat.com, eduardo.otubo@profitbricks.com

> Should it enable seccomp a bit later?

Ideally it should be enabled as late as possible, right before the main loop,
because here's no reason to whitelist syscalls that are only ever needed to
start QEMU up (e.g. chroot, which is only used before the guest even boots).
But for now, the simplest solution to the -chroot and -runas issue I can
think
of is to enable those syscalls in my patch.