From 9dc923f3797c18112813ce691d228919badc8837 Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Sun, 7 Dec 2025 20:13:31 +0100 Subject: [PATCH] seccomp: Allow fcntl in virtio-block thread Add fcntl to virtio_block_thread_rules to allow try_clone() on file descriptors. The try_clone() method uses fcntl(fd, F_DUPFD_CLOEXEC) to duplicate file descriptors, which is needed for efficient QCOW2 L1 table sync that avoids temporary allocations. Signed-off-by: Anatol Belski --- virtio-devices/src/seccomp_filters.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs index 9c8cc3e7d..07601b68a 100644 --- a/virtio-devices/src/seccomp_filters.rs +++ b/virtio-devices/src/seccomp_filters.rs @@ -99,6 +99,7 @@ fn virtio_balloon_thread_rules() -> Vec<(i64, Vec)> { fn virtio_block_thread_rules() -> Vec<(i64, Vec)> { vec![ (libc::SYS_fallocate, vec![]), + (libc::SYS_fcntl, vec![]), (libc::SYS_fdatasync, vec![]), (libc::SYS_fsync, vec![]), (libc::SYS_ftruncate, vec![]),