diff options
| -rwxr-xr-x | configure | 32 | ||||
| -rw-r--r-- | qemu-seccomp.c | 13 |
2 files changed, 37 insertions, 8 deletions
diff --git a/configure b/configure index f75df4b68f..0a4c78a743 100755 --- a/configure +++ b/configure @@ -1888,16 +1888,34 @@ fi # libseccomp check if test "$seccomp" != "no" ; then - if test "$cpu" = "i386" || test "$cpu" = "x86_64" && - $pkg_config --atleast-version=2.1.1 libseccomp; then + case "$cpu" in + i386|x86_64) + libseccomp_minver="2.1.0" + ;; + arm|aarch64) + libseccomp_minver="2.2.3" + ;; + *) + libseccomp_minver="" + ;; + esac + + if test "$libseccomp_minver" != "" && + $pkg_config --atleast-version=$libseccomp_minver libseccomp ; then libs_softmmu="$libs_softmmu `$pkg_config --libs libseccomp`" QEMU_CFLAGS="$QEMU_CFLAGS `$pkg_config --cflags libseccomp`" - seccomp="yes" + seccomp="yes" else - if test "$seccomp" = "yes"; then - feature_not_found "libseccomp" "Install libseccomp devel >= 2.1.1" - fi - seccomp="no" + if test "$seccomp" = "yes" ; then + if test "$libseccomp_minver" != "" ; then + feature_not_found "libseccomp" \ + "Install libseccomp devel >= $libseccomp_minver" + else + feature_not_found "libseccomp" \ + "libseccomp is not supported for host cpu $cpu" + fi + fi + seccomp="no" fi fi ########################################## diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 80d034a8d5..c831fe83ad 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -16,6 +16,14 @@ #include <seccomp.h> #include "sysemu/seccomp.h" +#if SCMP_VER_MAJOR >= 3 + #define HAVE_CACHEFLUSH +#elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 3 + #define HAVE_CACHEFLUSH +#elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR == 2 && SCMP_VER_MICRO >= 3 + #define HAVE_CACHEFLUSH +#endif + struct QemuSeccompSyscall { int32_t num; uint8_t priority; @@ -238,7 +246,10 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(inotify_init1), 240 }, { SCMP_SYS(inotify_add_watch), 240 }, { SCMP_SYS(mbind), 240 }, - { SCMP_SYS(memfd_create), 240 } + { SCMP_SYS(memfd_create), 240 }, +#ifdef HAVE_CACHEFLUSH + { SCMP_SYS(cacheflush), 240 }, +#endif }; int seccomp_start(void) |