From d68c388cacba96f41fef7e6bfa85320503d6fa41 Mon Sep 17 00:00:00 2001 From: Sebastien Boeuf Date: Thu, 15 Jul 2021 09:45:41 +0200 Subject: [PATCH] vmm: Update seccomp filters for HTTP thread The micro-http crate now uses recvmsg() syscall in order to receive file descriptors through control messages. This means the syscall must be part of the authorized list in the seccomp filters. Signed-off-by: Sebastien Boeuf --- vmm/src/seccomp_filters.rs | 1 + 1 file changed, 1 insertion(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index c86173777..1e31b48fd 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -595,6 +595,7 @@ fn api_thread_rules() -> Result, Error> { allow_syscall(libc::SYS_mprotect), allow_syscall(libc::SYS_munmap), allow_syscall(libc::SYS_recvfrom), + allow_syscall(libc::SYS_recvmsg), allow_syscall(libc::SYS_sigaltstack), allow_syscall(libc::SYS_write), ])