From ec157d7eb9f5915512efcd0660a78b41be8bc87e Mon Sep 17 00:00:00 2001 From: Ruben Hakobyan Date: Fri, 5 Jun 2026 01:04:35 -0700 Subject: [PATCH] seccomp: allow openat + read on the HTTP API thread under KVM SEV-SNP The KVM SEV-SNP net-hotplug integration tests (supported added in later commits) intermittently kill the VMM with SIGSYS on the http-server thread. The thread is seen reading /proc/sys/vm/overcommit_memory (openat + read). Allow the syscalls there, gated on sev_snp+kvm. seccomp can't match a path, so the open is restricted to O_RDONLY. Assisted-by: Claude:Opus-4.8 Signed-off-by: Ruben Hakobyan --- vmm/src/seccomp_filters.rs | 14 ++++++++++++++ 1 file changed, 14 insertions(+) diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 88f2ecc13..aba02305a 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -12,6 +12,8 @@ use libc::{ TIOCSPTLCK, TUNGETFEATURES, TUNGETIFF, TUNSETIFF, TUNSETOFFLOAD, TUNSETVNETHDRSZ, }; use seccompiler::SeccompCmpOp::Eq; +#[cfg(all(feature = "sev_snp", feature = "kvm"))] +use seccompiler::SeccompCmpOp::MaskedEq; use seccompiler::{ BackendError, BpfProgram, Error, SeccompAction, SeccompCmpArgLen as ArgLen, SeccompCondition as Cond, SeccompFilter, SeccompRule, @@ -973,7 +975,19 @@ fn http_api_thread_rules() -> Result)>, BackendError> (libc::SYS_mmap, vec![]), (libc::SYS_mprotect, vec![]), (libc::SYS_munmap, vec![]), + #[cfg(all(feature = "sev_snp", feature = "kvm"))] + ( + libc::SYS_openat, + or![and![Cond::new( + 2, // openat() flags argument + ArgLen::Dword, + MaskedEq(libc::O_ACCMODE as u64), + libc::O_RDONLY as u64, + )?]], + ), (libc::SYS_prctl, vec![]), + #[cfg(all(feature = "sev_snp", feature = "kvm"))] + (libc::SYS_read, vec![]), (libc::SYS_recvfrom, vec![]), (libc::SYS_recvmsg, vec![]), (libc::SYS_rt_sigprocmask, vec![]),