From 9f4714c32a287c199a1a6ff5f2db7744f32b4a03 Mon Sep 17 00:00:00 2001 From: Sebastien Boeuf Date: Wed, 24 Jun 2020 11:23:34 +0200 Subject: [PATCH] vmm: Extend seccomp filters with KVM_KVMCLOCK_CTRL Now that the VMM uses KVM_KVMCLOCK_CTRL from the KVM API, it must be added to the seccomp filters list. Signed-off-by: Sebastien Boeuf --- vmm/src/seccomp_filters.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 8399f18b2..ab875be8b 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -52,6 +52,7 @@ const KVM_CREATE_VCPU: u64 = 0xae41; const KVM_SET_TSS_ADDR: u64 = 0xae47; const KVM_CREATE_IRQCHIP: u64 = 0xae60; const KVM_RUN: u64 = 0xae80; +const KVM_KVMCLOCK_CTRL: u64 = 0xaead; const KVM_SET_MP_STATE: u64 = 0x4004_ae99; const KVM_SET_GSI_ROUTING: u64 = 0x4008_ae6a; const KVM_SET_MSRS: u64 = 0x4008_ae89; @@ -139,6 +140,7 @@ fn create_vmm_ioctl_seccomp_rule() -> Result, Error> { and![Cond::new(1, ArgLen::DWORD, Eq, KVM_GET_XCRS,)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_IOEVENTFD)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_IRQFD)?], + and![Cond::new(1, ArgLen::DWORD, Eq, KVM_KVMCLOCK_CTRL)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_RUN)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_SET_CLOCK)?], and![Cond::new(1, ArgLen::DWORD, Eq, KVM_SET_CPUID2)?],