virtio-devices: seccomp: Add seccomp_filter module

This patch added the seccomp_filter module to the virtio-devices crate
by taking reference code from the vmm crate. This patch also adds
allowed-list for the virtio-block worker thread.

Partially fixes: #925

Signed-off-by: Bo Chen <chen.bo@intel.com>

vmm/src/device_manager.rs

@@ -54,6 +54,7 @@ use pci::{
     VfioPciDevice,
 };
 use qcow::{self, ImageType, QcowFile};
+use seccomp::SeccompAction;
 #[cfg(feature = "pci_support")]
 use std::any::Any;
 use std::collections::HashMap;
@@ -801,6 +802,9 @@ pub struct DeviceManager {
 
     #[cfg(target_arch = "aarch64")]
     id_to_dev_info: HashMap<(DeviceType, String), MMIODeviceInfo>,
+
+    // seccomp action
+    seccomp_action: SeccompAction,
 }
 
 impl DeviceManager {
@@ -811,6 +815,7 @@ impl DeviceManager {
         _exit_evt: &EventFd,
         #[cfg_attr(target_arch = "aarch64", allow(unused_variables))] reset_evt: &EventFd,
         vmm_path: PathBuf,
+        seccomp_action: SeccompAction,
     ) -> DeviceManagerResult<Arc<Mutex<Self>>> {
         let device_tree = Arc::new(Mutex::new(DeviceTree::new()));
 
@@ -872,6 +877,7 @@ impl DeviceManager {
             reset_evt: reset_evt.try_clone().map_err(DeviceManagerError::EventFd)?,
             #[cfg(target_arch = "aarch64")]
             id_to_dev_info: HashMap::new(),
+            seccomp_action,
         };
 
         #[cfg(feature = "acpi")]
@@ -1710,6 +1716,7 @@ impl DeviceManager {
                                     disk_cfg.iommu,
                                     disk_cfg.num_queues,
                                     disk_cfg.queue_size,
+                                    self.seccomp_action.clone(),
                                 )
                                 .map_err(DeviceManagerError::CreateVirtioBlock)?,
                             ));
@@ -1736,6 +1743,7 @@ impl DeviceManager {
                                 disk_cfg.iommu,
                                 disk_cfg.num_queues,
                                 disk_cfg.queue_size,
+                                self.seccomp_action.clone(),
                             )
                             .map_err(DeviceManagerError::CreateVirtioBlock)?,
                         ));
@@ -1762,6 +1770,7 @@ impl DeviceManager {
                             disk_cfg.iommu,
                             disk_cfg.num_queues,
                             disk_cfg.queue_size,
+                            self.seccomp_action.clone(),
                         )
                         .map_err(DeviceManagerError::CreateVirtioBlock)?,
                     ));

vmm/src/vm.rs

@@ -268,7 +268,7 @@ impl Vm {
         exit_evt: EventFd,
         reset_evt: EventFd,
         vmm_path: PathBuf,
-        _seccomp_action: &SeccompAction,
+        seccomp_action: &SeccompAction,
         hypervisor: Arc<dyn hypervisor::Hypervisor>,
         _saved_clock: Option<hypervisor::ClockData>,
     ) -> Result<Self> {
@@ -285,6 +285,7 @@ impl Vm {
             &exit_evt,
             &reset_evt,
             vmm_path,
+            seccomp_action.clone(),
         )
         .map_err(Error::DeviceManager)?;