mirror of
https://github.com/cloud-hypervisor/cloud-hypervisor.git
synced 2024-08-21 07:21:15 +00:00
vmm: seccomp: whitelist KVM_GET_REG_LIST
in seccomp
`KVM_GET_REG_LIST` ioctl is needed in save/restore AArch64 vCPU. Therefore we whitelist this ioctl in seccomp. Also this commit unifies the `SYS_FTRUNCATE` syscall for x86_64 and AArch64. Signed-off-by: Henry Wang <Henry.Wang@arm.com>
This commit is contained in:
parent
c6b47d39e0
commit
48544e4e82
@ -106,6 +106,7 @@ const KVM_GET_ONE_REG: u64 = 0x4010_aeab;
|
|||||||
const KVM_GET_REGS: u64 = 0x8090_ae81;
|
const KVM_GET_REGS: u64 = 0x8090_ae81;
|
||||||
const KVM_GET_SUPPORTED_CPUID: u64 = 0xc008_ae05;
|
const KVM_GET_SUPPORTED_CPUID: u64 = 0xc008_ae05;
|
||||||
const KVM_CREATE_DEVICE: u64 = 0xc00c_aee0;
|
const KVM_CREATE_DEVICE: u64 = 0xc00c_aee0;
|
||||||
|
const KVM_GET_REG_LIST: u64 = 0xc008_aeb0;
|
||||||
|
|
||||||
fn create_vmm_ioctl_seccomp_rule_common() -> Result<Vec<SeccompRule>, Error> {
|
fn create_vmm_ioctl_seccomp_rule_common() -> Result<Vec<SeccompRule>, Error> {
|
||||||
Ok(or![
|
Ok(or![
|
||||||
@ -122,6 +123,7 @@ fn create_vmm_ioctl_seccomp_rule_common() -> Result<Vec<SeccompRule>, Error> {
|
|||||||
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_MP_STATE)?],
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_MP_STATE)?],
|
||||||
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_ONE_REG)?],
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_ONE_REG)?],
|
||||||
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_REGS)?],
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_REGS)?],
|
||||||
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_REG_LIST)?],
|
||||||
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_SUPPORTED_CPUID,)?],
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_SUPPORTED_CPUID,)?],
|
||||||
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_VCPU_EVENTS,)?],
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_VCPU_EVENTS,)?],
|
||||||
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_VCPU_MMAP_SIZE,)?],
|
and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_VCPU_MMAP_SIZE,)?],
|
||||||
|
Loading…
Reference in New Issue
Block a user