diff options
| author | Peter Maydell <peter.maydell@linaro.org> | 2018-09-28 14:17:12 +0100 |
|---|---|---|
| committer | Peter Maydell <peter.maydell@linaro.org> | 2018-09-28 14:17:12 +0100 |
| commit | 567ea80834fc8ec6b0f143cc884403abd0fde65c (patch) | |
| tree | 5e0db07105da047aa0398602f4964c8db64cc074 | |
| parent | 099bea113ffba7380b45f174eb54d45d4b801ef2 (diff) | |
| parent | 5780760f5ea6163939a5dabe7427318b4f07d1a2 (diff) | |
| download | focaccia-qemu-567ea80834fc8ec6b0f143cc884403abd0fde65c.tar.gz focaccia-qemu-567ea80834fc8ec6b0f143cc884403abd0fde65c.zip | |
Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20180926' into staging
pull-seccomp-20180926 # gpg: Signature made Wed 26 Sep 2018 14:20:06 BST # gpg: using RSA key DF32E7C0F0FFF9A2 # gpg: Good signature from "Eduardo Otubo (Senior Software Engineer) <otubo@redhat.com>" # Primary key fingerprint: D67E 1B50 9374 86B4 0723 DBAB DF32 E7C0 F0FF F9A2 * remotes/otubo/tags/pull-seccomp-20180926: seccomp: check TSYNC host capability Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
| -rw-r--r-- | qemu-seccomp.c | 19 | ||||
| -rw-r--r-- | vl.c | 4 |
2 files changed, 20 insertions, 3 deletions
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 4729eb107f..1baa5c69ed 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -282,7 +282,24 @@ static QemuOptsList qemu_sandbox_opts = { static void seccomp_register(void) { - qemu_add_opts(&qemu_sandbox_opts); + bool add = false; + + /* FIXME: use seccomp_api_get() >= 2 check when released */ + +#if defined(SECCOMP_FILTER_FLAG_TSYNC) + int check; + + /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */ + check = qemu_seccomp(SECCOMP_SET_MODE_FILTER, + SECCOMP_FILTER_FLAG_TSYNC, NULL); + if (check < 0 && errno == EFAULT) { + add = true; + } +#endif + + if (add) { + qemu_add_opts(&qemu_sandbox_opts); + } } opts_init(seccomp_register); #endif diff --git a/vl.c b/vl.c index 694bb67890..3b5c9d3f2d 100644 --- a/vl.c +++ b/vl.c @@ -3917,8 +3917,8 @@ int main(int argc, char **argv, char **envp) } #ifdef CONFIG_SECCOMP - if (qemu_opts_foreach(qemu_find_opts("sandbox"), - parse_sandbox, NULL, NULL)) { + olist = qemu_find_opts_err("sandbox", NULL); + if (olist && qemu_opts_foreach(olist, parse_sandbox, NULL, NULL)) { exit(1); } #endif |