kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

seccomp: allow openat + read on the HTTP API thread under KVM SEV-SNP

Browse Source 
The KVM SEV-SNP net-hotplug integration tests (supported added in
later commits) intermittently kill the VMM with SIGSYS on the
http-server thread. The thread is seen reading
/proc/sys/vm/overcommit_memory (openat + read).

Allow the syscalls there, gated on sev_snp+kvm. seccomp can't match
a path, so the open is restricted to O_RDONLY.

Assisted-by: Claude:Opus-4.8
Signed-off-by: Ruben Hakobyan <hruben@meta.com>
This commit is contained in:
Ruben Hakobyan
2026-06-05 01:04:35 -07:00
committed by Rob Bradford
parent dc6a56a0db
commit ec157d7eb9
1 changed files with 14 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

14
vmm/src/seccomp_filters.rs
View File

@@ -12,6 +12,8 @@ use libc::{
TIOCSPTLCK, TUNGETFEATURES, TUNGETIFF, TUNSETIFF, TUNSETOFFLOAD, TUNSETVNETHDRSZ,
};
use seccompiler::SeccompCmpOp::Eq;
#[cfg(all(feature = "sev_snp", feature = "kvm"))]
use seccompiler::SeccompCmpOp::MaskedEq;
use seccompiler::{
BackendError, BpfProgram, Error, SeccompAction, SeccompCmpArgLen as ArgLen,
SeccompCondition as Cond, SeccompFilter, SeccompRule,
@@ -973,7 +975,19 @@ fn http_api_thread_rules() -> Result<Vec<(i64, Vec<SeccompRule>)>, BackendError>
(libc::SYS_mmap, vec![]),
(libc::SYS_mprotect, vec![]),
(libc::SYS_munmap, vec![]),
#[cfg(all(feature = "sev_snp", feature = "kvm"))]
(
libc::SYS_openat,
or![and![Cond::new(
2, // openat() flags argument
ArgLen::Dword,
MaskedEq(libc::O_ACCMODE as u64),
libc::O_RDONLY as u64,
)?]],
),
(libc::SYS_prctl, vec![]),
#[cfg(all(feature = "sev_snp", feature = "kvm"))]
(libc::SYS_read, vec![]),
(libc::SYS_recvfrom, vec![]),
(libc::SYS_recvmsg, vec![]),
(libc::SYS_rt_sigprocmask, vec![]),