Rob Bradford 660b18eaac vmm: Clean up seccomp handling for glibc overcommit sysctl ...

Unfortunately glibc can read the overcommit sysctl from any thread. This
has lead to us adding a patchwork of openat/read syscalls to our allow
list when those threads don't necessarily need openat for their actual
uses.

Only the VMM and migration worker thread have a strict requirement for
the openat syscall. The syscall was added to the other threads to deal
with this glibc behaviour.

As read() is itself harmless move it to the common syscalls, strip
full openat() from all but the threads that need it and add limited,
read only, openat to all threads.

Signed-off-by: Rob Bradford <rbradford@meta.com>

2026-07-29 10:25:42 +00:00

..

src

vmm: Clean up seccomp handling for glibc overcommit sysctl

2026-07-29 10:25:42 +00:00

build.rs

build: Add "fuzzing" as a valid cfg(..) attribute

2024-05-08 08:10:28 +00:00

Cargo.toml

virtio-devices: Use SmallVec for descriptor chains

2026-07-08 02:15:19 +00:00