From c5dba9ea3b73d21d61e98d293dd41b2f4a2f68cc Mon Sep 17 00:00:00 2001 From: Anatol Belski Date: Wed, 25 Mar 2026 22:44:43 +0100 Subject: [PATCH] vmm: seccomp: Allow BLKGETSIZE64 ioctl Add BLKGETSIZE64 0x80081272 to the VMM seccomp ioctl allow list alongside the existing BLK* ioctls. This is needed for querying block device size without seeking. Signed-off-by: Anatol Belski --- vmm/src/seccomp_filters.rs | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index d29576151..97f020e65 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -110,9 +110,10 @@ mod kvm { pub const KVM_SET_NESTED_STATE: u64 = 1082175167; } -// Block device ioctls for sparse support probing (not exported by libc) +// Block device ioctls (not exported by libc) const BLKDISCARD: u64 = 0x1277; // _IO(0x12, 119) const BLKZEROOUT: u64 = 0x127f; // _IO(0x12, 127) +const BLKGETSIZE64: u64 = 0x80081272; // _IOR(0x12, 114, size_t) // MSHV IOCTL code. This is unstable until the kernel code has been declared stable. #[cfg(feature = "mshv")] @@ -265,6 +266,7 @@ fn create_vmm_ioctl_seccomp_rule_common( and![Cond::new(1, ArgLen::Dword, Eq, BLKPBSZGET as _)?], and![Cond::new(1, ArgLen::Dword, Eq, BLKIOMIN as _)?], and![Cond::new(1, ArgLen::Dword, Eq, BLKIOOPT as _)?], + and![Cond::new(1, ArgLen::Dword, Eq, BLKGETSIZE64 as _)?], and![Cond::new(1, ArgLen::Dword, Eq, BLKDISCARD as _)?], and![Cond::new(1, ArgLen::Dword, Eq, BLKZEROOUT as _)?], and![Cond::new(1, ArgLen::Dword, Eq, FIOCLEX as _)?],