[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH for-1.7] seccomp: setting "-sandbox on" by defau

From: Paolo Bonzini
Subject: Re: [Qemu-devel] [PATCH for-1.7] seccomp: setting "-sandbox on" by default
Date: Thu, 21 Nov 2013 16:14:11 +0100
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130923 Thunderbird/17.0.9

Il 30/10/2013 11:04, Stefan Hajnoczi ha scritto:
> On Wed, Oct 23, 2013 at 12:42:34PM -0200, Eduardo Otubo wrote:
>> On 10/22/2013 11:00 AM, Anthony Liguori wrote:
>>> On Tue, Oct 22, 2013 at 12:21 PM, Eduardo Otubo
>>> <address@hidden> wrote:
>>>> Inverting the way sandbox handles arguments, making possible to have no
>>>> argument and still have '-sandbox on' enabled.
>>>> Signed-off-by: Eduardo Otubo <address@hidden>
>>>> ---
>>>> The option '-sandbox on' is now used by default by virt-test[0] -- it has 
>>>> been
>>>> merged into the 'next' branch and will be available in the next release,
>>>> meaning we have a back support for regression tests if anything breaks 
>>>> because
>>>> of some missing system call not listed in the whitelist.
>>>> This being said, I think it makes sense to have this option set to 'on' by
>>>> default in the next Qemu version. It's been a while since no missing 
>>>> syscall is
>>>> reported and at this point the whitelist seems to be pretty mature.
>>>> [0] - 
>>>> https://github.com/autotest/virt-test/commit/50e1f7d47a94f4c770880cd8ec0f18365dcba714
>>> This breaks hot_add of a network device that uses a script= argument, 
>>> correct?
>>> If so, this cannot be made default.
>> Anthony, I believe you're talking about the blacklist feature. This
>> is the old whitelist that is already upstream and it does not block
>> any network device to be hot plugged.
> The following fails to start here (the shell hangs and ps shows QEMU is
> a <defunct> process):
> qemu-system-x86_64 -sandbox on -enable-kvm -m 1024 -cpu host \
>                    -drive if=virtio,cache=none,file=test.img

Easier-to-debug failures are another prerequisite for enabling the
sandbox by default, I think.


reply via email to

[Prev in Thread] Current Thread [Next in Thread]