[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCHv2 0/3] seccomp: adding blacklist support with comman

From: Eduardo Otubo
Subject: [Qemu-devel] [PATCHv2 0/3] seccomp: adding blacklist support with command line
Date: Fri, 6 Sep 2013 16:21:45 -0300

v2: The blacklist works exactly the opposite as the whitelist. I set the
default behaiour to SCMP_ACT_ALLOW and the exceptions to SCMP_ACT_KILL;
remembering it inherits the behavior from the previous installed whitelist.

This patch series also contain the command line support for this feature and
some minor fixes, all of them described in their own commit messages.

v1: The second whitelist is installed right before the vcpu starts, it contains 
the system calls the first one has except for exec() and select(), which are
big major syscalls that I could extensively test with virt-test and do not
cause any damage to the general execution.

The environment in which the second whitelist is installed seems to need less
system calls than the first, so the procedure here will be the same: Keep
testing with virt-test and get to the smallest list as possible.

Eduardo Otubo (3):
  seccomp: adding blacklist support
  seccomp: adding command line support for blacklist
  seccomp: general fixes

 include/sysemu/seccomp.h |  5 +++-
 qemu-options.hx          |  8 ++++---
 qemu-seccomp.c           | 60 +++++++++++++++++++++++++++++++++++++-----------
 vl.c                     | 31 +++++++++++++++++++++----
 4 files changed, 83 insertions(+), 21 deletions(-)


reply via email to

[Prev in Thread] Current Thread [Next in Thread]