kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm, virtio-devices: Add missing seccomp rules for MSHV

Browse Source 
This patch adds all the seccomp rules missing for MSHV.
With this patch MSFT internal CI runs with seccomp enabled.

Signed-off-by: Muminul Islam <muislam@microsoft.com>
This commit is contained in:
Muminul Islam
2021-08-02 11:38:42 -07:00
committed by Bo Chen
parent c597655d06
commit 83c44a2411
2 changed files with 13 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
virtio-devices/src/seccomp_filters.rs
View File

@@ -77,6 +77,8 @@ fn create_virtio_mem_ioctl_seccomp_rule() -> Vec<SeccompRule> {
fn virtio_balloon_thread_rules() -> Vec<SyscallRuleSet> {
vec![
allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1),
@@ -329,6 +331,8 @@ fn virtio_rng_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_vhost_fs_thread_rules() -> Vec<SyscallRuleSet> {
vec![
allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_connect),
allow_syscall(libc::SYS_dup),
@@ -357,6 +361,8 @@ fn virtio_vhost_fs_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_vhost_net_ctl_thread_rules() -> Vec<SyscallRuleSet> {
vec![
allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1),
@@ -383,6 +389,8 @@ fn virtio_vsock_thread_rules() -> Vec<SyscallRuleSet> {
vec![
allow_syscall(libc::SYS_accept4),
allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1),
@@ -406,6 +414,8 @@ fn virtio_vsock_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_watchdog_thread_rules() -> Vec<SyscallRuleSet> {
vec![
allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1),