From 0c967e1aa039ff2c8511bb80169eec90c55991f0 Mon Sep 17 00:00:00 2001 From: Sebastien Boeuf Date: Wed, 14 Oct 2020 17:19:12 +0200 Subject: [PATCH] virtio-devices: iommu: Update the list of seccomp filters While using the virtio-iommu device involving L2 scenario, and tearing things down all the way from L2 back to L0 exposed some bad syscalls that were not part of the authorized list. Signed-off-by: Sebastien Boeuf --- virtio-devices/src/seccomp_filters.rs | 7 +++++++ 1 file changed, 7 insertions(+) diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs index edd237bc2..d212f9de2 100644 --- a/virtio-devices/src/seccomp_filters.rs +++ b/virtio-devices/src/seccomp_filters.rs @@ -166,14 +166,21 @@ fn virtio_console_thread_rules() -> Result, Error> { fn virtio_iommu_thread_rules() -> Result, Error> { Ok(vec![ allow_syscall(libc::SYS_brk), + allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_ctl), allow_syscall(libc::SYS_epoll_pwait), #[cfg(target_arch = "x86_64")] allow_syscall(libc::SYS_epoll_wait), + allow_syscall(libc::SYS_exit), allow_syscall(libc::SYS_futex), + allow_syscall(libc::SYS_madvise), + allow_syscall(libc::SYS_mmap), + allow_syscall(libc::SYS_mprotect), + allow_syscall(libc::SYS_munmap), allow_syscall(libc::SYS_read), + allow_syscall(libc::SYS_sigaltstack), allow_syscall(libc::SYS_write), ]) }