From cb826aa2f1f86a72800d0e950d7f98d4ba09119f Mon Sep 17 00:00:00 2001 From: Rob Bradford Date: Mon, 11 Jan 2021 09:34:37 +0000 Subject: [PATCH] vmm: seccomp: Add open() to vCPU permitted syscalls Older libc (like RHEL7) uses open() rather than openat(). This was demonstrated through a failure to open /etc/localtime as used by gmtime() libc call trigged from the vCPU thread (CMOS device.) Fixes: #2111 Signed-off-by: Rob Bradford --- vmm/src/seccomp_filters.rs | 2 ++ 1 file changed, 2 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 3edb66fac..b81e1d720 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -447,6 +447,8 @@ fn vcpu_thread_rules() -> Result, Error> { allow_syscall(libc::SYS_mprotect), allow_syscall(libc::SYS_munmap), allow_syscall(libc::SYS_nanosleep), + #[cfg(target_arch = "x86_64")] + allow_syscall(libc::SYS_open), allow_syscall(libc::SYS_openat), #[cfg(target_arch = "aarch64")] allow_syscall(libc::SYS_newfstatat),