kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: Separate seccomp filters between VMM and API threads

Browse Source 
This separates the filters used between the VMM and API threads, so that
we can apply different rules for each thread.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
This commit is contained in:
Sebastien Boeuf
2020-03-20 17:57:03 +01:00
parent 5120c275a2
commit feb8d7ae90
3 changed files with 57 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
vmm/src/api/http.rs
View File

@@ -7,7 +7,7 @@ use crate::api::http_endpoint::{
VmActionHandler, VmAddDevice, VmCreate, VmInfo, VmRemoveDevice, VmResize, VmmPing, VmmShutdown,
};
use crate::api::{ApiRequest, VmAction};
use crate::seccomp_filters::get_seccomp_filter;
use crate::seccomp_filters::{get_seccomp_filter, Thread};
use crate::{Error, Result};
use micro_http::{HttpServer, MediaType, Request, Response, StatusCode, Version};
use seccomp::{SeccompFilter, SeccompLevel};
@@ -101,7 +101,7 @@ pub fn start_http_thread(
// Retrieve seccomp filter for API thread
let api_seccomp_filter =
get_seccomp_filter(seccomp_level).map_err(Error::CreateSeccompFilter)?;
get_seccomp_filter(seccomp_level, Thread::Api).map_err(Error::CreateSeccompFilter)?;
thread::Builder::new()
.name("http-server".to_string())