kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices, vmm: Fix the '--seccomp false' option

Browse Source 
We are relying on applying empty 'seccomp' filters to support the
'--seccomp false' option, which will be treated as an error with the
updated 'seccompiler' crate. This patch fixes this issue by explicitly
checking whether the 'seccomp' filter is empty before applying the
filter.

Signed-off-by: Bo Chen <chen.bo@intel.com>
This commit is contained in:
Bo Chen
2021-08-16 17:20:11 -07:00
committed by Sebastien Boeuf
parent 2d2463ce04
commit 7d38a1848b
16 changed files with 120 additions and 56 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
vmm/src/api/http.rs
View File

@@ -276,7 +276,9 @@ fn start_http_thread(
.name("http-server".to_string())
.spawn(move || {
// Apply seccomp filter for API thread.
apply_filter(&api_seccomp_filter).map_err(Error::ApplySeccompFilter)?;
if !api_seccomp_filter.is_empty() {
apply_filter(&api_seccomp_filter).map_err(Error::ApplySeccompFilter)?;
}
server.start_server().unwrap();
loop {

12
vmm/src/cpu.rs
View File

@@ -724,11 +724,13 @@ impl CpuManager {
.name(format!("vcpu{}", cpu_id))
.spawn(move || {
// Apply seccomp filter for vcpu thread.
if let Err(e) =
apply_filter(&vcpu_seccomp_filter).map_err(Error::ApplySeccompFilter)
{
error!("Error applying seccomp filter: {:?}", e);
return;
if !vcpu_seccomp_filter.is_empty() {
if let Err(e) =
apply_filter(&vcpu_seccomp_filter).map_err(Error::ApplySeccompFilter)
{
error!("Error applying seccomp filter: {:?}", e);
return;
}
}
extern "C" fn handle_signal(_: i32, _: *mut siginfo_t, _: *mut c_void) {}
// This uses an async signal safe handler to kill the vcpu handles.

4
vmm/src/lib.rs
View File

@@ -263,7 +263,9 @@ pub fn start_vmm_thread(
.name("vmm".to_string())
.spawn(move || {
// Apply seccomp filter for VMM thread.
apply_filter(&vmm_seccomp_filter).map_err(Error::ApplySeccompFilter)?;
if !vmm_seccomp_filter.is_empty() {
apply_filter(&vmm_seccomp_filter).map_err(Error::ApplySeccompFilter)?;
}
let mut vmm = Vmm::new(
vmm_version.to_string(),

24
vmm/src/vm.rs
View File

@@ -1880,11 +1880,13 @@ impl Vm {
thread::Builder::new()
.name("signal_handler".to_string())
.spawn(move || {
if let Err(e) = apply_filter(&signal_handler_seccomp_filter)
.map_err(Error::ApplySeccompFilter)
{
error!("Error applying seccomp filter: {:?}", e);
return;
if !signal_handler_seccomp_filter.is_empty() {
if let Err(e) = apply_filter(&signal_handler_seccomp_filter)
.map_err(Error::ApplySeccompFilter)
{
error!("Error applying seccomp filter: {:?}", e);
return;
}
}
Vm::os_signal_handler(signals, console, on_tty, exit_evt);
@@ -2442,11 +2444,13 @@ impl Snapshottable for Vm {
thread::Builder::new()
.name("signal_handler".to_string())
.spawn(move || {
if let Err(e) = apply_filter(&signal_handler_seccomp_filter)
.map_err(Error::ApplySeccompFilter)
{
error!("Error applying seccomp filter: {:?}", e);
return;
if !signal_handler_seccomp_filter.is_empty() {
if let Err(e) = apply_filter(&signal_handler_seccomp_filter)
.map_err(Error::ApplySeccompFilter)
{
error!("Error applying seccomp filter: {:?}", e);
return;
}
}
Vm::os_signal_handler(signals, console, on_tty, exit_evt)