From b3435d51d9e550beb1baadf8e19dcd776b626493 Mon Sep 17 00:00:00 2001 From: Sebastien Boeuf Date: Wed, 16 Sep 2020 11:18:14 +0200 Subject: [PATCH] vmm: cpu: Add missing io_uring syscalls to vCPU threads Some of the io_uring setup happens upon activation of the virtio-blk device, which is initially triggered through an MMIO VM exit. That's why the vCPU threads must authorize io_uring related syscalls. This commit ensures the virtio-blk io_uring implementation can be used along with the seccomp filters enabled. Signed-off-by: Sebastien Boeuf --- vmm/src/seccomp_filters.rs | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index acb6f1a60..5239c1e28 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -420,7 +420,11 @@ fn vcpu_thread_rules() -> Result, Error> { allow_syscall(libc::SYS_newfstatat), allow_syscall(libc::SYS_futex), allow_syscall(libc::SYS_getpid), + allow_syscall(libc::SYS_getrandom), allow_syscall_if(libc::SYS_ioctl, create_vcpu_ioctl_seccomp_rule()?), + allow_syscall(SYS_IO_URING_ENTER), + allow_syscall(SYS_IO_URING_SETUP), + allow_syscall(SYS_IO_URING_REGISTER), allow_syscall(libc::SYS_lseek), allow_syscall(libc::SYS_madvise), allow_syscall(libc::SYS_mmap),