diff options
| author | Daniel P. Berrangé <berrange@redhat.com> | 2020-09-11 15:18:32 +0100 |
|---|---|---|
| committer | Eduardo Otubo <otubo@redhat.com> | 2020-09-15 12:56:26 +0200 |
| commit | e474e3aacf4276eb0781d11c45e2fab996f9dc56 (patch) | |
| tree | 7a657f211a4c95e93cec5b9d1874bc191ca37a0e /qemu-seccomp.c | |
| parent | 2d2c73d0e3d504a61f868e46e6abd5643f38091b (diff) | |
seccomp: fix killing of whole process instead of thread
Back in 2018 we introduced support for killing the whole QEMU process
instead of just one thread, when a seccomp rule is violated:
commit bda08a5764d470f101fa38635d30b41179a313e1
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
Date: Wed Aug 22 19:02:48 2018 +0200
seccomp: prefer SCMP_ACT_KILL_PROCESS if available
Fast forward a year and we introduced a patch to avoid killing the
process for resource control syscalls tickled by Mesa.
commit 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8
Author: Daniel P. Berrangé <berrange@redhat.com>
Date: Wed Mar 13 09:49:03 2019 +0000
seccomp: don't kill process for resource control syscalls
Unfortunately a logic bug effectively reverted the first commit
mentioned so that we go back to only killing the thread, not the whole
process.
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Eduardo Otubo <otubo@redhat.com>
Diffstat (limited to 'qemu-seccomp.c')
| -rw-r--r-- | qemu-seccomp.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index e0a1829b3d..8325ecb766 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -136,8 +136,9 @@ static uint32_t qemu_seccomp_get_action(int set) if (qemu_seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0) { kill_process = 1; + } else { + kill_process = 0; } - kill_process = 0; } if (kill_process == 1) { return SCMP_ACT_KILL_PROCESS; |