Commit 5780760f authored by Marc-André Lureau's avatar Marc-André Lureau Committed by Eduardo Otubo
Browse files

seccomp: check TSYNC host capability 



Remove -sandbox option if the host is not capable of TSYNC, since the
sandbox will fail at setup time otherwise. This will help libvirt, for
ex, to figure out if -sandbox will work.

Signed-off-by: default avatarMarc-André Lureau <marcandre.lureau@redhat.com>
Signed-off-by: default avatarEduardo Otubo <otubo@redhat.com>
Acked-by: default avatarEduardo Otubo <otubo@redhat.com>
parent 19b599f7

qemu-seccomp.c

+18 −1
Original line number Diff line number Diff line
@@ -282,7 +282,24 @@ static QemuOptsList qemu_sandbox_opts = { 


static void seccomp_register(void)

{

    bool add = false;



    /* FIXME: use seccomp_api_get() >= 2 check when released */



#if defined(SECCOMP_FILTER_FLAG_TSYNC)

    int check;



    /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */

    check = qemu_seccomp(SECCOMP_SET_MODE_FILTER,

                         SECCOMP_FILTER_FLAG_TSYNC, NULL);

    if (check < 0 && errno == EFAULT) {

        add = true;

    }

#endif



    if (add) {

        qemu_add_opts(&qemu_sandbox_opts);

    }

}

opts_init(seccomp_register);

#endif

vl.c

+2 −2
Original line number Diff line number Diff line
@@ -4007,8 +4007,8 @@ int main(int argc, char **argv, char **envp) 
    }



#ifdef CONFIG_SECCOMP

    if (qemu_opts_foreach(qemu_find_opts("sandbox"),

                          parse_sandbox, NULL, NULL)) {

    olist = qemu_find_opts_err("sandbox", NULL);

    if (olist && qemu_opts_foreach(olist, parse_sandbox, NULL, NULL)) {

        exit(1);

    }

#endif