From 7d1321515cacd5dcfb85f559b3495a0306b1f57b Mon Sep 17 00:00:00 2001 From: wangyf0611 Date: Thu, 21 May 2026 15:48:01 +0800 Subject: [PATCH] vmm: Allow riscv64 path syscalls in seccomp filters riscv64 does not provide the legacy readlink and unlink syscalls, so libc uses readlinkat and unlinkat for paths that are otherwise allowed on other architectures. Permit readlinkat and unlinkat for the VMM and vCPU seccomp filters on riscv64, matching the existing aarch64 rules. Assisted-by: OpenAI-Codex:GPT-5 Signed-off-by: wangyf0611 --- vmm/src/seccomp_filters.rs | 8 ++++---- 1 file changed, 4 insertions(+), 4 deletions(-) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 0aeb6f979..8ee1d1708 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -710,7 +710,7 @@ fn vmm_thread_rules( (libc::SYS_readv, vec![]), #[cfg(target_arch = "x86_64")] (libc::SYS_readlink, vec![]), - #[cfg(target_arch = "aarch64")] + #[cfg(any(target_arch = "aarch64", target_arch = "riscv64"))] (libc::SYS_readlinkat, vec![]), (libc::SYS_recvfrom, vec![]), (libc::SYS_recvmsg, vec![]), @@ -753,7 +753,7 @@ fn vmm_thread_rules( ), #[cfg(target_arch = "x86_64")] (libc::SYS_unlink, vec![]), - #[cfg(target_arch = "aarch64")] + #[cfg(any(target_arch = "aarch64", target_arch = "riscv64"))] (libc::SYS_unlinkat, vec![]), (libc::SYS_userfaultfd, vec![]), (libc::SYS_wait4, vec![]), @@ -918,7 +918,7 @@ fn vcpu_thread_rules( (libc::SYS_read, vec![]), #[cfg(target_arch = "x86_64")] (libc::SYS_readlink, vec![]), - #[cfg(target_arch = "aarch64")] + #[cfg(any(target_arch = "aarch64", target_arch = "riscv64"))] (libc::SYS_readlinkat, vec![]), (libc::SYS_recvfrom, vec![]), (libc::SYS_recvmsg, vec![]), @@ -935,7 +935,7 @@ fn vcpu_thread_rules( (libc::SYS_tkill, vec![]), #[cfg(target_arch = "x86_64")] (libc::SYS_unlink, vec![]), - #[cfg(target_arch = "aarch64")] + #[cfg(any(target_arch = "aarch64", target_arch = "riscv64"))] (libc::SYS_unlinkat, vec![]), (libc::SYS_write, vec![]), (libc::SYS_writev, vec![]),