slackcoder/qemu - QEMU is a generic and open source machine & userspace emulator and virtualizer

Age	Commit message (Collapse)	Author
2022-02-16	seccomp: fix blocking of process spawning	Daniel P. Berrangé
	When '-sandbox on,spawn=deny' is given, we are supposed to block the ability to spawn processes. We naively blocked the 'fork' syscall, forgetting that any modern libc will use the 'clone' syscall instead. We can't simply block the 'clone' syscall though, as that will break thread creation. We thus list the set of flags used to create threads and block anything that doesn't match this exactly. Acked-by: Eduardo Otubo <otubo@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
2022-02-16	seccomp: add unit test for seccomp filtering	Daniel P. Berrangé
	The handling of some syscalls / libc function is quite subtle. For example, 'fork' at a libc level doesn't always correspond to 'fork' at a syscall level, since the 'clone' syscall is preferred usually. The unit test will help to detect these kind of problems. A point of difficulty in writing a test though is that the QEMU build process may already be confined by seccomp. For example, if running inside a container. Since we can't predict what filtering might have been applied already, we are quite conservative and skip all tests if we see any kind of seccomp filter active. Acked-by: Eduardo Otubo <otubo@redhat.com> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>