From 48544e4e82dba6131bf5964ada67b118802c6b2d Mon Sep 17 00:00:00 2001 From: Henry Wang Date: Sat, 5 Sep 2020 21:19:39 +0800 Subject: [PATCH] vmm: seccomp: whitelist `KVM_GET_REG_LIST` in seccomp `KVM_GET_REG_LIST` ioctl is needed in save/restore AArch64 vCPU. Therefore we whitelist this ioctl in seccomp. Also this commit unifies the `SYS_FTRUNCATE` syscall for x86_64 and AArch64. Signed-off-by: Henry Wang --- vmm/src/seccomp_filters.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index a8fe41026..0a62c63ff 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -106,6 +106,7 @@ const KVM_GET_ONE_REG: u64 = 0x4010_aeab; const KVM_GET_REGS: u64 = 0x8090_ae81; const KVM_GET_SUPPORTED_CPUID: u64 = 0xc008_ae05; const KVM_CREATE_DEVICE: u64 = 0xc00c_aee0; +const KVM_GET_REG_LIST: u64 = 0xc008_aeb0; fn create_vmm_ioctl_seccomp_rule_common() -> Result, Error> { Ok(or![ @@ -122,6 +123,7 @@ fn create_vmm_ioctl_seccomp_rule_common() -> Result, Error> { and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_MP_STATE)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_ONE_REG)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_REGS)?], + and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_REG_LIST)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_SUPPORTED_CPUID,)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_VCPU_EVENTS,)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_VCPU_MMAP_SIZE,)?],