virtio-devices: seccomp: Add seccomp filters for vhost_blk thread

This patch enables the seccomp filters for the vhost_blk worker thread.

Partially fixes: #925

Signed-off-by: Bo Chen <chen.bo@intel.com>

virtio-devices/src/vhost_user/blk.rs

@@ -5,9 +5,11 @@ use super::super::{ActivateError, ActivateResult, Queue, VirtioDevice, VirtioDev
 use super::handler::*;
 use super::vu_common_ctrl::*;
 use super::{Error, Result};
+use crate::seccomp_filters::{get_seccomp_filter, Thread};
 use crate::VirtioInterrupt;
 use block_util::VirtioBlockConfig;
 use libc::EFD_NONBLOCK;
+use seccomp::{SeccompAction, SeccompFilter};
 use std::mem;
 use std::os::unix::io::AsRawFd;
 use std::result;
@@ -43,11 +45,12 @@ pub struct Blk {
     epoll_threads: Option<Vec<thread::JoinHandle<()>>>,
     paused: Arc<AtomicBool>,
     paused_sync: Arc<Barrier>,
+    seccomp_action: SeccompAction,
 }
 
 impl Blk {
     /// Create a new vhost-user-blk device
-    pub fn new(id: String, vu_cfg: VhostUserConfig) -> Result<Blk> {
+    pub fn new(id: String, vu_cfg: VhostUserConfig, seccomp_action: SeccompAction) -> Result<Blk> {
         let mut vhost_user_blk = Master::connect(&vu_cfg.socket, vu_cfg.num_queues as u64)
             .map_err(Error::VhostUserCreateMaster)?;
 
@@ -148,6 +151,7 @@ impl Blk {
             epoll_threads: None,
             paused: Arc::new(AtomicBool::new(false)),
             paused_sync: Arc::new(Barrier::new(vu_cfg.num_queues + 1)),
+            seccomp_action,
         })
     }
 }
@@ -274,10 +278,15 @@ impl VirtioDevice for Blk {
 
             let paused = self.paused.clone();
             let paused_sync = self.paused_sync.clone();
+            let virtio_vhost_blk_seccomp_filter =
+                get_seccomp_filter(&self.seccomp_action, Thread::VirtioVhostBlk)
+                    .map_err(ActivateError::CreateSeccompFilter)?;
             thread::Builder::new()
-                .name("vhost_user_blk".to_string())
+                .name("vhost_blk".to_string())
                 .spawn(move || {
-                    if let Err(e) = handler.run(paused, paused_sync) {
+                    if let Err(e) = SeccompFilter::apply(virtio_vhost_blk_seccomp_filter) {
+                        error!("Error applying seccomp filter: {:?}", e);
+                    } else if let Err(e) = handler.run(paused, paused_sync) {
                         error!("Error running worker: {:?}", e);
                     }
                 })