kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices: seccomp: Allow fcntl unconditionally

Browse Source 
This now required after Rust-VMM crate bumps. Also reorder some syscalls
so that they are now in alphabetical order.

Signed-off-by: Rob Bradford <rbradford@meta.com>
This commit is contained in:
Rob Bradford
2026-03-22 11:27:55 +00:00
parent c79f3acfab
commit 4f52e9355e
2 changed files with 17 additions and 22 deletions
Download Patch File Download Diff File Expand all files Collapse all files
virtio-devices/src/seccomp_filters.rs
+4 -8
View File
@@ -146,11 +146,11 @@ fn virtio_mem_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
fn virtio_net_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
vec![
#[cfg(feature = "sev_snp")]
(libc::SYS_ioctl, create_mshv_sev_snp_ioctl_seccomp_rule()),
(libc::SYS_readv, vec![]),
(libc::SYS_timerfd_settime, vec![]),
(libc::SYS_writev, vec![]),
#[cfg(feature = "sev_snp")]
(libc::SYS_ioctl, create_mshv_sev_snp_ioctl_seccomp_rule()),
]
}
@@ -254,14 +254,11 @@ fn virtio_vsock_thread_rules() -> Vec<(i64, Vec<SeccompRule>)> {
vec![
(libc::SYS_accept4, vec![]),
(libc::SYS_connect, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_ioctl, create_vsock_ioctl_seccomp_rule()),
(libc::SYS_recvfrom, vec![]),
(libc::SYS_sendto, vec![]),
(libc::SYS_socket, vec![]),
// If debug_assertions is enabled, closing a file first checks
// whether the FD is valid with fcntl.
#[cfg(debug_assertions)]
(libc::SYS_fcntl, vec![]),
]
}
@@ -308,6 +305,7 @@ fn virtio_thread_common() -> Vec<(i64, Vec<SeccompRule>)> {
#[cfg(target_arch = "x86_64")]
(libc::SYS_epoll_wait, vec![]),
(libc::SYS_exit, vec![]),
(libc::SYS_fcntl, vec![]),
(libc::SYS_futex, vec![]),
(libc::SYS_gettid, vec![]),
(libc::SYS_madvise, vec![]),
@@ -321,8 +319,6 @@ fn virtio_thread_common() -> Vec<(i64, Vec<SeccompRule>)> {
(libc::SYS_rt_sigreturn, vec![]),
(libc::SYS_sigaltstack, vec![]),
(libc::SYS_write, vec![]),
#[cfg(debug_assertions)]
(libc::SYS_fcntl, vec![]),
]
}