kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: seccomp: Allow fcntl unconditionally

Browse Source 
This now required after Rust-VMM crate bumps. Also reorder some syscalls
so that they are now in alphabetical order.

Signed-off-by: Rob Bradford <rbradford@meta.com>
This commit is contained in:
Rob Bradford
2026-03-22 11:27:55 +00:00
parent c79f3acfab
commit 4f52e9355e
2 changed files with 17 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
virtio-devices/src/seccomp_filters.rs
View File

@@ -146,11 +146,11 @@ fn virtio_mem_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
fn virtio_net_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
vec![
#[cfg(feature = "sev_snp")]
(libc::SYS_ioctl, create_mshv_sev_snp_ioctl_seccomp_rule()),
(libc::SYS_readv, vec![]),
(libc::SYS_timerfd_settime, vec![]),
(libc::SYS_writev, vec![]),
#[cfg(feature = "sev_snp")]
(libc::SYS_ioctl, create_mshv_sev_snp_ioctl_seccomp_rule()),
]
}
@@ -254,14 +254,11 @@ fn virtio_vsock_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
vec![
(libc::SYS_accept4, vec![]),
(libc::SYS_connect, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_ioctl, create_vsock_ioctl_seccomp_rule()),
(libc::SYS_recvfrom, vec![]),
(libc::SYS_sendto, vec![]),
(libc::SYS_socket, vec![]),
// If debug_assertions is enabled, closing a file first checks
// whether the FD is valid with fcntl.
#[cfg(debug_assertions)]
(libc::SYS_fcntl, vec![]),
]
}
@@ -308,6 +305,7 @@ fn virtio_thread_common() -> Vec<(i64, Vec<SeccompRule>)> {
#[cfg(target_arch = "x86_64")]
(libc::SYS_epoll_wait, vec![]),
(libc::SYS_exit, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_madvise, vec![]),
@@ -321,8 +319,6 @@ fn virtio_thread_common() -> Vec<(i64, Vec<SeccompRule>)> {
(libc::SYS_rt_sigreturn, vec![]),
(libc::SYS_sigaltstack, vec![]),
(libc::SYS_write, vec![]),
#[cfg(debug_assertions)]
(libc::SYS_fcntl, vec![]),
]
}

27
vmm/src/seccomp_filters.rs
View File

@@ -501,6 +501,7 @@ fn signal_handler_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, Backend
(libc::SYS_close, vec![]),
(libc::SYS_exit, vec![]),
(libc::SYS_exit_group, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_ioctl, create_signal_handler_ioctl_seccomp_rule()?),
(libc::SYS_landlock_create_ruleset, vec![]),
@@ -517,8 +518,6 @@ fn signal_handler_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, Backend
(libc::SYS_sendto, vec![]),
(libc::SYS_sigaltstack, vec![]),
(libc::SYS_write, vec![]),
#[cfg(debug_assertions)]
(libc::SYS_fcntl, vec![]),
])
}
@@ -534,7 +533,10 @@ fn pty_foreground_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, Backend
Ok(vec![
(libc::SYS_close, vec![]),
(libc::SYS_exit_group, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_getcwd, vec![]),
(libc::SYS_getpgid, vec![]),
(libc::SYS_gettid, vec![]),
#[cfg(target_arch = "x86_64")]
(libc::SYS_getpgrp, vec![]),
(libc::SYS_ioctl, create_pty_foreground_ioctl_seccomp_rule()?),
@@ -549,12 +551,8 @@ fn pty_foreground_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, Backend
(libc::SYS_rt_sigreturn, vec![]),
(libc::SYS_sched_yield, vec![]),
(libc::SYS_setsid, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_sigaltstack, vec![]),
(libc::SYS_write, vec![]),
#[cfg(debug_assertions)]
(libc::SYS_fcntl, vec![]),
(libc::SYS_getcwd, vec![]),
])
}
@@ -598,6 +596,7 @@ fn vmm_thread_rules(
#[cfg(target_arch = "aarch64")]
(libc::SYS_newfstatat, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_getcwd, vec![]),
(libc::SYS_getdents64, vec![]),
(libc::SYS_getpgid, vec![]),
#[cfg(target_arch = "x86_64")]
@@ -701,7 +700,6 @@ fn vmm_thread_rules(
(libc::SYS_wait4, vec![]),
(libc::SYS_write, vec![]),
(libc::SYS_writev, vec![]),
(libc::SYS_getcwd, vec![]),
])
}
@@ -801,11 +799,13 @@ fn vcpu_thread_rules(
(libc::SYS_dup, vec![]),
(libc::SYS_exit, vec![]),
(libc::SYS_epoll_ctl, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_fstat, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_getcwd, vec![]),
(libc::SYS_getrandom, vec![]),
(libc::SYS_getpid, vec![]),
(libc::SYS_gettid, vec![]),
(
libc::SYS_ioctl,
create_vcpu_ioctl_seccomp_rule(hypervisor_type)?,
@@ -842,8 +842,6 @@ fn vcpu_thread_rules(
(libc::SYS_unlinkat, vec![]),
(libc::SYS_write, vec![]),
(libc::SYS_writev, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_getcwd, vec![]),
])
}
@@ -863,6 +861,7 @@ fn http_api_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError>
(libc::SYS_epoll_wait, vec![]),
(libc::SYS_exit, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_getcwd, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_getrandom, vec![]),
@@ -876,12 +875,11 @@ fn http_api_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError>
(libc::SYS_prctl, vec![]),
(libc::SYS_recvfrom, vec![]),
(libc::SYS_recvmsg, vec![]),
(libc::SYS_rt_sigprocmask, vec![]),
(libc::SYS_sched_yield, vec![]),
(libc::SYS_sendto, vec![]),
(libc::SYS_sigaltstack, vec![]),
(libc::SYS_write, vec![]),
(libc::SYS_rt_sigprocmask, vec![]),
(libc::SYS_getcwd, vec![]),
])
}
@@ -899,7 +897,9 @@ fn dbus_api_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError>
(libc::SYS_epoll_ctl, vec![]),
(libc::SYS_exit, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_getcwd, vec![]),
(libc::SYS_getrandom, vec![]),
(libc::SYS_madvise, vec![]),
(libc::SYS_mmap, vec![]),
@@ -915,7 +915,6 @@ fn dbus_api_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError>
(libc::SYS_set_robust_list, vec![]),
(libc::SYS_sigaltstack, vec![]),
(libc::SYS_write, vec![]),
(libc::SYS_getcwd, vec![]),
])
}
@@ -923,6 +922,7 @@ fn event_monitor_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendE
Ok(vec![
(libc::SYS_brk, vec![]),
(libc::SYS_close, vec![]),
(libc::SYS_getcwd, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_landlock_create_ruleset, vec![]),
@@ -932,7 +932,6 @@ fn event_monitor_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendE
(libc::SYS_prctl, vec![]),
(libc::SYS_sched_yield, vec![]),
(libc::SYS_write, vec![]),
(libc::SYS_getcwd, vec![]),
])
}