kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: seccomp: Add seccomp filter for vhost_net thread

Browse Source 
This patch enables the seccomp filters for the vhost_net worker thread.

Partially fixes: #925

Signed-off-by: Bo Chen <chen.bo@intel.com>
This commit is contained in:
Bo Chen
2020-08-17 21:53:08 -07:00
committed by Sebastien Boeuf
parent 896b9a1d4b
commit 4e0ea15075
2 changed files with 25 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
virtio-devices/src/vhost_user/net.rs
View File

@@ -318,10 +318,15 @@ impl VirtioDevice for Net {
let paused = self.paused.clone();
let paused_sync = self.paused_sync.clone();
let virtio_vhost_net_seccomp_filter =
get_seccomp_filter(&self.seccomp_action, Thread::VirtioVhostNet)
.map_err(ActivateError::CreateSeccompFilter)?;
thread::Builder::new()
.name("vhost_user_net".to_string())
.name("vhost_net".to_string())
.spawn(move || {
if let Err(e) = handler.run(paused, paused_sync) {
if let Err(e) = SeccompFilter::apply(virtio_vhost_net_seccomp_filter) {
error!("Error applying seccomp filter: {:?}", e);
} else if let Err(e) = handler.run(paused, paused_sync) {
error!("Error running worker: {:?}", e);
}
})