From 90acb01bad60ad729497845829cc14d481b9ddf3 Mon Sep 17 00:00:00 2001 From: Jose Carlos Venegas Munoz Date: Wed, 5 Aug 2020 16:58:20 +0000 Subject: [PATCH] vmm: seccomp: add mprotect to API thread filter Add mprotect to API thread rules. Prevent the VMM is killed when it is used. Signed-off-by: Jose Carlos Venegas Munoz --- vmm/src/seccomp_filters.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index aea9a3c0c..ad595a3df 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -363,6 +363,7 @@ fn api_thread_rules() -> Result, Error> { allow_syscall_if(libc::SYS_ioctl, create_api_ioctl_seccomp_rule()?), allow_syscall(libc::SYS_listen), allow_syscall(libc::SYS_madvise), + allow_syscall(libc::SYS_mprotect), allow_syscall(libc::SYS_munmap), allow_syscall(libc::SYS_recvfrom), allow_syscall(libc::SYS_sigaltstack),