From d2f71cebca6f0c66dba21853b58c9b15bab54c60 Mon Sep 17 00:00:00 2001 From: Bo Chen Date: Mon, 30 Oct 2023 11:26:56 -0700 Subject: [PATCH] virtio-devices, vmm: Update seccomp list The seccompiler v0.4.0 started to use `seccomp` syscall instead of the `prctl` syscall. Also, threads for virtio-deivces should not need any of these syscalls anyway. Signed-off-by: Bo Chen --- virtio-devices/src/seccomp_filters.rs | 4 ---- vmm/src/seccomp_filters.rs | 1 + 2 files changed, 1 insertion(+), 4 deletions(-) diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs index 31a4edc0f..41585e778 100644 --- a/virtio-devices/src/seccomp_filters.rs +++ b/virtio-devices/src/seccomp_filters.rs @@ -91,7 +91,6 @@ fn virtio_block_thread_rules() -> Vec<(i64, Vec)> { (libc::SYS_io_submit, vec![]), (libc::SYS_io_uring_enter, vec![]), (libc::SYS_lseek, vec![]), - (libc::SYS_prctl, vec![]), (libc::SYS_pread64, vec![]), (libc::SYS_preadv, vec![]), (libc::SYS_pwritev, vec![]), @@ -105,7 +104,6 @@ fn virtio_block_thread_rules() -> Vec<(i64, Vec)> { fn virtio_console_thread_rules() -> Vec<(i64, Vec)> { vec![ (libc::SYS_ioctl, create_virtio_console_ioctl_seccomp_rule()), - (libc::SYS_prctl, vec![]), (libc::SYS_sched_getaffinity, vec![]), (libc::SYS_set_robust_list, vec![]), ] @@ -146,7 +144,6 @@ fn virtio_pmem_thread_rules() -> Vec<(i64, Vec)> { fn virtio_rng_thread_rules() -> Vec<(i64, Vec)> { vec![ - (libc::SYS_prctl, vec![]), (libc::SYS_sched_getaffinity, vec![]), (libc::SYS_set_robust_list, vec![]), ] @@ -217,7 +214,6 @@ fn virtio_vsock_thread_rules() -> Vec<(i64, Vec)> { fn virtio_watchdog_thread_rules() -> Vec<(i64, Vec)> { vec![ - (libc::SYS_prctl, vec![]), (libc::SYS_sched_getaffinity, vec![]), (libc::SYS_set_robust_list, vec![]), (libc::SYS_timerfd_settime, vec![]), diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 83f73a278..debc779a3 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -607,6 +607,7 @@ fn vmm_thread_rules( (libc::SYS_rt_sigreturn, vec![]), (libc::SYS_sched_getaffinity, vec![]), (libc::SYS_sched_setaffinity, vec![]), + (libc::SYS_seccomp, vec![]), (libc::SYS_sendmsg, vec![]), (libc::SYS_sendto, vec![]), (libc::SYS_set_robust_list, vec![]),