kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm, virtio-devices:seccomp: Add MSHV related seccomp rule

Browse Source 
MSHV needs SYS_clock_gettime to pause and resume
the guest VM.

Signed-off-by: Muminul Islam <muislam@microsoft.com>
This commit is contained in:
Muminul Islam
2021-07-12 14:41:24 -07:00
committed by Bo Chen
parent 3937e03c02
commit e481f97550
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
virtio-devices/src/seccomp_filters.rs
+16
View File
@@ -99,6 +99,8 @@ fn virtio_balloon_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_block_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_block_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -142,6 +144,8 @@ fn virtio_block_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_console_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_console_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -168,6 +172,8 @@ fn virtio_console_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_iommu_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_iommu_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -191,6 +197,8 @@ fn virtio_iommu_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_mem_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_mem_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -214,6 +222,8 @@ fn virtio_mem_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_net_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_net_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -243,6 +253,8 @@ fn create_virtio_net_ctl_ioctl_seccomp_rule() -> Result<Vec<SeccompRule>, Error>
fn virtio_net_ctl_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> { fn virtio_net_ctl_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
Ok(vec![ Ok(vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -265,6 +277,8 @@ fn virtio_net_ctl_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
fn virtio_pmem_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_pmem_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),
@@ -287,6 +301,8 @@ fn virtio_pmem_thread_rules() -> Vec<SyscallRuleSet> {
fn virtio_rng_thread_rules() -> Vec<SyscallRuleSet> { fn virtio_rng_thread_rules() -> Vec<SyscallRuleSet> {
vec![ vec![
allow_syscall(libc::SYS_brk), allow_syscall(libc::SYS_brk),
#[cfg(feature = "mshv")]
allow_syscall(libc::SYS_clock_gettime),
allow_syscall(libc::SYS_close), allow_syscall(libc::SYS_close),
allow_syscall(libc::SYS_dup), allow_syscall(libc::SYS_dup),
allow_syscall(libc::SYS_epoll_create1), allow_syscall(libc::SYS_epoll_create1),