The previous fix for setns/execveat/unshare mistakenly copy and pasted the clone_args filter, which is inappropriate for these syscalls and had the effect of weakening the seccomp filter.
Fixes: f33fb19cab (seccomp: fix blocking of setns/execveat/unshare) Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/4671 Reviewed-by: Marc-André Lureau <[email protected]> Signed-off-by: Daniel P. Berrangé <[email protected]> --- system/qemu-seccomp.c | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/system/qemu-seccomp.c b/system/qemu-seccomp.c index 3889d48b4f2..cd2c1b0b747 100644 --- a/system/qemu-seccomp.c +++ b/system/qemu-seccomp.c @@ -250,12 +250,12 @@ static const struct QemuSeccompSyscall denylist[] = { #endif #ifdef __SNR_execveat { SCMP_SYS(execveat), QEMU_SECCOMP_SET_SPAWN, - ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) }, + 0, NULL, SCMP_ACT_ERRNO(EPERM) }, #endif { SCMP_SYS(setns), QEMU_SECCOMP_SET_SPAWN, - ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) }, + 0, NULL, SCMP_ACT_ERRNO(EPERM) }, { SCMP_SYS(unshare), QEMU_SECCOMP_SET_SPAWN, - ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) }, + 0, NULL, SCMP_ACT_ERRNO(EPERM) }, /* resource control */ { SCMP_SYS(setpriority), QEMU_SECCOMP_SET_RESOURCECTL, 0, NULL, SCMP_ACT_ERRNO(EPERM) }, -- 2.56.0
