vmm: add seccomp filter for serial-manager thread

The serial-manager thread was the only VMM-managed thread without a
seccomp filter. Add a Thread::SerialManager variant and whitelist the
31 syscalls needed for its epoll-based I/O loop (read, write, socket
ops, signal handling, memory allocation, glibc internals).

The filter is computed in start_thread() and applied before the epoll
loop, matching the pattern used by other VMM threads.

Signed-off-by: Wei Liu <liuwe@microsoft.com>
Assisted-by: Pi-agent:Claude-Opus-4.7

vmm/src/serial_manager.rs

@@ -21,11 +21,13 @@ use devices::legacy::Pl011;
 use devices::legacy::Serial;
 use libc::EFD_NONBLOCK;
 use log::{error, info, warn};
+use seccompiler::{SeccompAction, apply_filter};
 use serial_buffer::SerialBuffer;
 use thiserror::Error;
 use vmm_sys_util::eventfd::EventFd;
 
 use crate::console_devices::ConsoleTransport;
+use crate::seccomp_filters::{Thread, get_seccomp_filter};
 
 #[derive(Debug, Error)]
 pub enum Error {
@@ -84,6 +86,14 @@ pub enum Error {
     /// Cannot duplicate file descriptor
     #[error("Error duplicating file descriptor")]
     DupFd(#[source] io::Error),
+
+    /// Cannot create seccomp filter.
+    #[error("Error creating seccomp filter")]
+    CreateSeccompFilter(seccompiler::Error),
+
+    /// Cannot apply seccomp filter.
+    #[error("Error applying seccomp filter")]
+    ApplySeccompFilter(seccompiler::Error),
 }
 pub type Result<T> = result::Result<T, Error>;
 
@@ -250,13 +260,20 @@ impl SerialManager {
         Ok(())
     }
 
-    pub fn start_thread(&mut self, exit_evt: EventFd) -> Result<()> {
+    pub fn start_thread(
+        &mut self,
+        exit_evt: EventFd,
+        seccomp_action: &SeccompAction,
+    ) -> Result<()> {
         // Don't allow this to be run if the handle exists
         if self.handle.is_some() {
             warn!("Tried to start multiple SerialManager threads, ignoring");
             return Ok(());
         }
 
+        let seccomp_filter = get_seccomp_filter(seccomp_action, Thread::SerialManager, None)
+            .map_err(Error::CreateSeccompFilter)?;
+
         let epoll_fd = self.epoll_fd.try_clone().map_err(Error::Epoll)?;
         let transport = self.transport.clone();
         let serial = self.serial.clone();
@@ -275,6 +292,11 @@ impl SerialManager {
             .name("serial-manager".to_string())
             .spawn(move || {
                 std::panic::catch_unwind(AssertUnwindSafe(move || {
+                    // Apply seccomp filter for serial manager thread.
+                    if !seccomp_filter.is_empty() {
+                        apply_filter(&seccomp_filter).map_err(Error::ApplySeccompFilter)?;
+                    }
+
                     let mut events =
                         [epoll::Event::new(epoll::Events::empty(), 0); EPOLL_EVENTS_LEN];