v1: * Full seccomp calls and data included in vl.c v2: * Full seccomp calls and data removed from vl.c and put into separate qemu-seccomp.[ch] file.
v4: * Call to install_seccomp_syscall_debug() added. * Now calling seccomp_start() with 'SECCOMP_MODE' argument, depending on settings used in configure script. Signed-off-by: Eduardo Otubo <ot...@linux.vnet.ibm.com> --- vl.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/vl.c b/vl.c index 46248b9..8dc9432 100644 --- a/vl.c +++ b/vl.c @@ -62,6 +62,14 @@ #include <linux/ppdev.h> #include <linux/parport.h> #endif + +#ifdef CONFIG_SECCOMP +#include "qemu-seccomp.h" +#endif +#ifdef CONFIG_SECCOMP_DEBUG +#include "qemu-seccomp-debug.h" +#endif + #ifdef __sun__ #include <sys/stat.h> #include <sys/ethernet.h> @@ -169,6 +177,14 @@ int main(int argc, char **argv) #define MAX_VIRTIO_CONSOLES 1 +#ifdef CONFIG_SECCOMP +#ifdef CONFIG_SECCOMP_DEBUG +#define SECCOMP_MODE SCMP_ACT_TRAP +#else +#define SECCOMP_MODE SCMP_ACT_KILL +#endif +#endif + static const char *data_dir; const char *bios_name = NULL; enum vga_retrace_method vga_retrace_method = VGA_RETRACE_DUMB; @@ -2295,6 +2311,21 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; +#ifdef CONFIG_SECCOMP_DEBUG + if (install_seccomp_syscall_debug()) { + fprintf(stderr, "seccomp: failed to install system call debug\n"); + exit(1); + } +#endif + +#ifdef CONFIG_SECCOMP + if (seccomp_start(SECCOMP_MODE) < 0) { + fprintf(stderr, + "seccomp: failed to install syscall filter in the kernel\n"); + exit(1); + } +#endif + atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]); -- 1.7.9.5