External/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2025-02-22 11:22:26 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: Update the http thread's seccomp filter

Browse Source 
Because the http thread no longer needs to create the api socket,
remove the socket, bind and listen syscalls from the seccomp filter.

Signed-off-by: William Douglas <william.douglas@intel.com>
This commit is contained in:
William Douglas 2021-04-28 11:27:12 -07:00 committed by Rob Bradford
parent b8779ddc9e
commit a2cfe71c0a
1 changed files with 0 additions and 3 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
vmm/src/seccomp_filters.rs
View File

@ -461,7 +461,6 @@ fn vcpu_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
fn api_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> { fn api_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
Ok(vec![ Ok(vec![
allow_syscall(libc::SYS_accept4), allow_syscall(libc::SYS_accept4),
allow_syscall(libc::SYS_bind),
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
@ -474,13 +473,11 @@ fn api_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
allow_syscall(libc::SYS_futex), allow_syscall(libc::SYS_futex),
allow_syscall(libc::SYS_getrandom), allow_syscall(libc::SYS_getrandom),
allow_syscall_if(libc::SYS_ioctl, create_api_ioctl_seccomp_rule()?), allow_syscall_if(libc::SYS_ioctl, create_api_ioctl_seccomp_rule()?),
allow_syscall(libc::SYS_listen),
allow_syscall(libc::SYS_madvise), allow_syscall(libc::SYS_madvise),
allow_syscall(libc::SYS_mprotect), allow_syscall(libc::SYS_mprotect),
allow_syscall(libc::SYS_munmap), allow_syscall(libc::SYS_munmap),
allow_syscall(libc::SYS_recvfrom), allow_syscall(libc::SYS_recvfrom),
allow_syscall(libc::SYS_sigaltstack), allow_syscall(libc::SYS_sigaltstack),
allow_syscall(libc::SYS_socket),
allow_syscall(libc::SYS_write), allow_syscall(libc::SYS_write),
]) ])
} }