From aa49668cc3cc680187e9e9b1d2eb8d64d72bff3e Mon Sep 17 00:00:00 2001 From: Eduardo Otubo Date: Fri, 19 Dec 2014 17:13:38 +0100 Subject: [PATCH 1/2] seccomp: typo in configure error message Error message was misleading people to install wrong version of libseccomp. Signed-off-by: Eduardo Otubo --- configure | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/configure b/configure index cae588c128..7539645521 100755 --- a/configure +++ b/configure @@ -1830,7 +1830,7 @@ if test "$seccomp" != "no" ; then seccomp="yes" else if test "$seccomp" = "yes"; then - feature_not_found "libseccomp" "Install libseccomp devel >= 2.1.0" + feature_not_found "libseccomp" "Install libseccomp devel >= 2.1.1" fi seccomp="no" fi From ea259acae5b2d88ee6e92caf1cf44eb501eaef47 Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Wed, 17 Dec 2014 15:50:09 -0500 Subject: [PATCH 2/2] seccomp: add mbind() to the syscall whitelist The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to set the policy for a memory range. Add the syscall to the seccomp sandbox whitelist. Signed-off-by: Paul Moore Signed-off-by: Eduardo Otubo Acked-by: Eduardo Otubo Tested-by: Eduardo Habkost Reviewed-by: Eduardo Habkost --- qemu-seccomp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index af6a375127..b0c626984f 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(fallocate), 240 }, { SCMP_SYS(fadvise64), 240 }, { SCMP_SYS(inotify_init1), 240 }, - { SCMP_SYS(inotify_add_watch), 240 } + { SCMP_SYS(inotify_add_watch), 240 }, + { SCMP_SYS(mbind), 240 } }; int seccomp_start(void)