mirrors/qemu
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Command line support for seccomp with -sandbox (v8)

Browse Source 
Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: Anthony Liguori <aliguori@us.ibm.com>
---
v7 -> v8
 - Parse options correctly (aliguori)
This commit is contained in:
Eduardo Otubo 2012-08-14 18:44:08 -03:00 committed by Anthony Liguori
parent 452dfbef60
commit 7d76ad4fa4
4 changed files with 55 additions and 8 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

14
qemu-config.c
View File

@ -362,6 +362,19 @@ static QemuOptsList qemu_global_opts = {
},
};
QemuOptsList qemu_sandbox_opts = {
.name = "sandbox",
.implied_opt_name = "enable",
.head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head),
.desc = {
{
.name = "enable",
.type = QEMU_OPT_BOOL,
},
{ /* end of list */ }
},
};
static QemuOptsList qemu_mon_opts = {
.name = "mon",
.implied_opt_name = "chardev",
@ -645,6 +658,7 @@ static QemuOptsList *vm_config_groups[32] = {
&qemu_machine_opts,
&qemu_boot_opts,
&qemu_iscsi_opts,
&qemu_sandbox_opts,
NULL,
};

1
qemu-config.h
View File

@ -6,6 +6,7 @@
extern QemuOptsList qemu_fsdev_opts;
extern QemuOptsList qemu_virtfs_opts;
extern QemuOptsList qemu_spice_opts;
extern QemuOptsList qemu_sandbox_opts;
QemuOptsList *qemu_find_opts(const char *group);
QemuOptsList *qemu_find_opts_err(const char *group, Error **errp);

10
qemu-options.hx
View File

@ -2723,6 +2723,16 @@ STEXI
Old param mode (ARM only).
ETEXI
DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
"-sandbox <arg> Enable seccomp mode 2 system call filter (default 'off').\n",
QEMU_ARCH_ALL)
STEXI
@item -sandbox
@findex -sandbox
Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will
disable it. The default is 'off'.
ETEXI
DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig,
"-readconfig <file>\n", QEMU_ARCH_ALL)
STEXI

38
vl.c
View File

@ -770,6 +770,26 @@ static int bt_parse(const char *opt)
return 1;
}
static int parse_sandbox(QemuOpts *opts, void *opaque)
{
/* FIXME: change this to true for 1.3 */
if (qemu_opt_get_bool(opts, "enable", false)) {
#ifdef CONFIG_SECCOMP
if (seccomp_start() < 0) {
qerror_report(ERROR_CLASS_GENERIC_ERROR,
"failed to install seccomp syscall filter in the kernel");
return -1;
}
#else
qerror_report(ERROR_CLASS_GENERIC_ERROR,
"sandboxing request but seccomp is not compiled into this build");
return -1;
#endif
}
return 0;
}
/***********************************************************/
/* QEMU Block devices */
@ -2349,14 +2369,6 @@ int main(int argc, char **argv, char **envp)
const char *trace_events = NULL;
const char *trace_file = NULL;
#ifdef CONFIG_SECCOMP
if (seccomp_start() < 0) {
fprintf(stderr,
"seccomp: failed to install syscall filter in the kernel\n");
exit(1);
}
#endif
atexit(qemu_run_exit_notifiers);
error_set_progname(argv[0]);
@ -3260,6 +3272,12 @@ int main(int argc, char **argv, char **envp)
case QEMU_OPTION_qtest_log:
qtest_log = optarg;
break;
case QEMU_OPTION_sandbox:
opts = qemu_opts_parse(qemu_find_opts("sandbox"), optarg, 1);
if (!opts) {
exit(0);
}
break;
default:
os_parse_cmd_args(popt->index, optarg);
}
@ -3267,6 +3285,10 @@ int main(int argc, char **argv, char **envp)
}
loc_set_none();
if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL, 0)) {
exit(1);
}
if (machine == NULL) {
fprintf(stderr, "No machine found.\n");
exit(1);