diff options
| -rw-r--r-- | qemu-config.c | 14 | ||||
| -rw-r--r-- | qemu-config.h | 1 | ||||
| -rw-r--r-- | qemu-options.hx | 10 | ||||
| -rw-r--r-- | vl.c | 38 |
4 files changed, 55 insertions, 8 deletions
diff --git a/qemu-config.c b/qemu-config.c index 6700de0c71..c05ffbc444 100644 --- a/qemu-config.c +++ b/qemu-config.c @@ -362,6 +362,19 @@ static QemuOptsList qemu_global_opts = { }, }; +QemuOptsList qemu_sandbox_opts = { + .name = "sandbox", + .implied_opt_name = "enable", + .head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head), + .desc = { + { + .name = "enable", + .type = QEMU_OPT_BOOL, + }, + { /* end of list */ } + }, +}; + static QemuOptsList qemu_mon_opts = { .name = "mon", .implied_opt_name = "chardev", @@ -645,6 +658,7 @@ static QemuOptsList *vm_config_groups[32] = { &qemu_machine_opts, &qemu_boot_opts, &qemu_iscsi_opts, + &qemu_sandbox_opts, NULL, }; diff --git a/qemu-config.h b/qemu-config.h index 12ddf3ed97..5557562c33 100644 --- a/qemu-config.h +++ b/qemu-config.h @@ -6,6 +6,7 @@ extern QemuOptsList qemu_fsdev_opts; extern QemuOptsList qemu_virtfs_opts; extern QemuOptsList qemu_spice_opts; +extern QemuOptsList qemu_sandbox_opts; QemuOptsList *qemu_find_opts(const char *group); QemuOptsList *qemu_find_opts_err(const char *group, Error **errp); diff --git a/qemu-options.hx b/qemu-options.hx index 6aeef6a845..3c411c427e 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2723,6 +2723,16 @@ STEXI Old param mode (ARM only). ETEXI +DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \ + "-sandbox <arg> Enable seccomp mode 2 system call filter (default 'off').\n", + QEMU_ARCH_ALL) +STEXI +@item -sandbox +@findex -sandbox +Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will +disable it. The default is 'off'. +ETEXI + DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig, "-readconfig <file>\n", QEMU_ARCH_ALL) STEXI @@ -770,6 +770,26 @@ static int bt_parse(const char *opt) return 1; } +static int parse_sandbox(QemuOpts *opts, void *opaque) +{ + /* FIXME: change this to true for 1.3 */ + if (qemu_opt_get_bool(opts, "enable", false)) { +#ifdef CONFIG_SECCOMP + if (seccomp_start() < 0) { + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "failed to install seccomp syscall filter in the kernel"); + return -1; + } +#else + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "sandboxing request but seccomp is not compiled into this build"); + return -1; +#endif + } + + return 0; +} + /***********************************************************/ /* QEMU Block devices */ @@ -2349,14 +2369,6 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; -#ifdef CONFIG_SECCOMP - if (seccomp_start() < 0) { - fprintf(stderr, - "seccomp: failed to install syscall filter in the kernel\n"); - exit(1); - } -#endif - atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]); @@ -3260,6 +3272,12 @@ int main(int argc, char **argv, char **envp) case QEMU_OPTION_qtest_log: qtest_log = optarg; break; + case QEMU_OPTION_sandbox: + opts = qemu_opts_parse(qemu_find_opts("sandbox"), optarg, 1); + if (!opts) { + exit(0); + } + break; default: os_parse_cmd_args(popt->index, optarg); } @@ -3267,6 +3285,10 @@ int main(int argc, char **argv, char **envp) } loc_set_none(); + if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL, 0)) { + exit(1); + } + if (machine == NULL) { fprintf(stderr, "No machine found.\n"); exit(1); |