From 93538564266f1afa9e945c59ba6fbca362ddba6f Mon Sep 17 00:00:00 2001 From: Sebastien Boeuf Date: Wed, 10 Feb 2021 18:17:54 +0100 Subject: [PATCH] vmm: Fix seccomp filters for vCPUs Depending on the host OS the code for looking up the time for the CMOS make require extra syscalls to be permitted for the vCPU thread. Signed-off-by: Sebastien Boeuf Signed-off-by: Rob Bradford --- vmm/src/seccomp_filters.rs | 3 +++ 1 file changed, 3 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 4feb5ca48..69b475578 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -417,9 +417,11 @@ fn vcpu_thread_rules() -> Result, Error> { allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_exit), + allow_syscall(libc::SYS_fstat), allow_syscall(libc::SYS_futex), allow_syscall(libc::SYS_getpid), allow_syscall_if(libc::SYS_ioctl, create_vcpu_ioctl_seccomp_rule()?), + allow_syscall(libc::SYS_lseek), allow_syscall(libc::SYS_madvise), allow_syscall(libc::SYS_mprotect), allow_syscall(libc::SYS_munmap), @@ -429,6 +431,7 @@ fn vcpu_thread_rules() -> Result, Error> { allow_syscall(libc::SYS_openat), allow_syscall(libc::SYS_pread64), allow_syscall(libc::SYS_pwrite64), + allow_syscall(libc::SYS_read), allow_syscall(libc::SYS_recvmsg), allow_syscall(libc::SYS_rt_sigaction), allow_syscall(libc::SYS_rt_sigprocmask),