Re: [Qemu-devel] [PATCH] seccomp: "-sandbox on" won't kill Qemu when option not built in

[Eduardo Otubo]

On 12/10/2013 04:48 PM, Lucas Meneghel Rodrigues wrote:
> On 12/10/2013 01:20 AM, Corey Bryant wrote:
> > > > IMHO the test suite should probe to see if sandbox is working or not,
> > > > and
> > > > just not use the "-sandbox on" arg if the host doesn't support it.
> > >
> > > But I think this could be done on virt-test as well :)
> >
> > This would make sense.
> >
> > Although it sounds like Lucas was looking for an error message when
> > seccomp kills qemu.  Maybe virt-test could grep the audit log for the
> > existence of a "type=SECCOMP" record within the test's time of
> > execution, and issue a message based on that.
>
> It's a valid idea. The problem I see with it is that not every distro
> out there uses SELinux. Not getting into the merits of whether they
> should, ideally it'd be nice to have this working on distros that won't
> use SELinux.

Completely misunderstanding, I feel sorry for that.

While we can't rely on the fact that every distro will have audit log 
working properly, I can start working on some support for virt-test to 
detect if the host machine has support for seccomp or if the Qemu binary 
has this feature built in.

Again, sorry for the mess. Please disconsider this patch.

--
Eduardo Otubo
IBM Linux Technology Center