From 444905071bd5794d0eba069b451654f34e09d297 Mon Sep 17 00:00:00 2001 From: Rob Bradford Date: Wed, 16 Dec 2020 16:59:02 +0000 Subject: [PATCH] vmm: seccomp: Permit TUNGETIFF through the filter This is used to obtain the TAP device name. Signed-off-by: Rob Bradford --- vmm/src/seccomp_filters.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 3cd8f732d..3ee25fa25 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -51,6 +51,7 @@ const FIOCLEX: u64 = 0x5451; const FIONBIO: u64 = 0x5421; // See include/uapi/linux/if_tun.h in the kernel code. +const TUNGETIFF: u64 = 0x8004_54d2; const TUNSETIFF: u64 = 0x4004_54ca; const TUNSETOFFLOAD: u64 = 0x4004_54d0; const TUNSETVNETHDRSZ: u64 = 0x4004_54d8; @@ -155,6 +156,7 @@ fn create_vmm_ioctl_seccomp_rule_common() -> Result, Error> { and![Cond::new(1, ArgLen::DWORD, Eq, TCGETS)?], and![Cond::new(1, ArgLen::DWORD, Eq, TIOCGWINSZ)?], and![Cond::new(1, ArgLen::DWORD, Eq, TUNGETFEATURES)?], + and![Cond::new(1, ArgLen::DWORD, Eq, TUNGETIFF)?], and![Cond::new(1, ArgLen::DWORD, Eq, TUNSETIFF)?], and![Cond::new(1, ArgLen::DWORD, Eq, TUNSETOFFLOAD)?], and![Cond::new(1, ArgLen::DWORD, Eq, TUNSETVNETHDRSZ)?],