kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: Separate seccomp filters between VMM and API threads

Browse Source 
This separates the filters used between the VMM and API threads, so that
we can apply different rules for each thread.

Signed-off-by: Sebastien Boeuf <sebastien.boeuf@intel.com>
This commit is contained in:
Sebastien Boeuf
2020-03-20 17:57:03 +01:00
parent 5120c275a2
commit feb8d7ae90
3 changed files with 57 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
vmm/src/lib.rs
View File

@@ -17,7 +17,7 @@ extern crate vmm_sys_util;
use crate::api::{ApiError, ApiRequest, ApiResponse, ApiResponsePayload, VmInfo, VmmPingResponse};
use crate::config::{DeviceConfig, VmConfig};
use crate::seccomp_filters::get_seccomp_filter;
use crate::seccomp_filters::{get_seccomp_filter, Thread};
use crate::vm::{Error as VmError, Vm, VmState};
use libc::EFD_NONBLOCK;
use seccomp::{SeccompFilter, SeccompLevel};
@@ -176,7 +176,7 @@ pub fn start_vmm_thread(
// Retrieve seccomp filter
let vmm_seccomp_filter =
get_seccomp_filter(seccomp_level).map_err(Error::CreateSeccompFilter)?;
get_seccomp_filter(seccomp_level, Thread::Vmm).map_err(Error::CreateSeccompFilter)?;
// Find the path that the "/proc/<pid>/exe" symlink points to. Must be done before spawning
// a thread as Rust does not put the child threads in the same thread group which prevents the