diff options
| author | Marc-André Lureau <marcandre.lureau@redhat.com> | 2018-08-30 16:33:48 +0200 |
|---|---|---|
| committer | Eduardo Otubo <otubo@redhat.com> | 2018-09-26 15:07:35 +0200 |
| commit | 5780760f5ea6163939a5dabe7427318b4f07d1a2 (patch) | |
| tree | 4977ed2945bec3e1bc0e8ee70ab79147ae5e4697 /qemu-seccomp.c | |
| parent | 19b599f7664b2ebfd0f405fb79c14dd241557452 (diff) | |
| download | focaccia-qemu-5780760f5ea6163939a5dabe7427318b4f07d1a2.tar.gz focaccia-qemu-5780760f5ea6163939a5dabe7427318b4f07d1a2.zip | |
seccomp: check TSYNC host capability
Remove -sandbox option if the host is not capable of TSYNC, since the sandbox will fail at setup time otherwise. This will help libvirt, for ex, to figure out if -sandbox will work. Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com> Signed-off-by: Eduardo Otubo <otubo@redhat.com> Acked-by: Eduardo Otubo <otubo@redhat.com>
Diffstat (limited to 'qemu-seccomp.c')
| -rw-r--r-- | qemu-seccomp.c | 19 |
1 files changed, 18 insertions, 1 deletions
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 4729eb107f..1baa5c69ed 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -282,7 +282,24 @@ static QemuOptsList qemu_sandbox_opts = { static void seccomp_register(void) { - qemu_add_opts(&qemu_sandbox_opts); + bool add = false; + + /* FIXME: use seccomp_api_get() >= 2 check when released */ + +#if defined(SECCOMP_FILTER_FLAG_TSYNC) + int check; + + /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */ + check = qemu_seccomp(SECCOMP_SET_MODE_FILTER, + SECCOMP_FILTER_FLAG_TSYNC, NULL); + if (check < 0 && errno == EFAULT) { + add = true; + } +#endif + + if (add) { + qemu_add_opts(&qemu_sandbox_opts); + } } opts_init(seccomp_register); #endif |