From aaa02a0d787ce86144a74794d1b3198e3b1df8cb Mon Sep 17 00:00:00 2001 From: Bo Chen Date: Mon, 17 Aug 2020 10:12:02 -0700 Subject: [PATCH] virtio-devices: seccomp: Add 'brk' syscall to all worker threads To prevent potential failures, this patch adds 'brk' syscall to all virtio-devices worker threads. Signed-off-by: Bo Chen --- virtio-devices/src/seccomp_filters.rs | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs index 062cfd2b0..7d397a5ef 100644 --- a/virtio-devices/src/seccomp_filters.rs +++ b/virtio-devices/src/seccomp_filters.rs @@ -60,6 +60,7 @@ fn virtio_blk_thread_rules() -> Result, Error> { fn virtio_console_thread_rules() -> Result, Error> { Ok(vec![ + allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_epoll_create1), @@ -85,6 +86,7 @@ fn virtio_console_thread_rules() -> Result, Error> { fn virtio_iommu_thread_rules() -> Result, Error> { Ok(vec![ + allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_ctl), allow_syscall(libc::SYS_dup), @@ -99,6 +101,7 @@ fn virtio_iommu_thread_rules() -> Result, Error> { fn virtio_net_thread_rules() -> Result, Error> { Ok(vec![ + allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_ctl), @@ -119,6 +122,7 @@ fn virtio_net_thread_rules() -> Result, Error> { fn virtio_net_ctl_thread_rules() -> Result, Error> { Ok(vec![ + allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_epoll_create1), @@ -138,6 +142,7 @@ fn virtio_net_ctl_thread_rules() -> Result, Error> { fn virtio_pmem_thread_rules() -> Result, Error> { Ok(vec![ + allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_epoll_create1),