Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Paul Moore
On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 09/03/2013 02:21 PM, Paul Moore wrote: On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Eduardo Otubo
On 09/03/2013 03:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Eduardo Otubo
On 09/03/2013 03:21 PM, Paul Moore wrote: On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Paul Moore
On Tuesday, September 03, 2013 05:07:53 PM Eduardo Otubo wrote: On 09/03/2013 03:21 PM, Paul Moore wrote: On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 09/03/2013 04:05 PM, Eduardo Otubo wrote: On 09/03/2013 03:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-02 Thread Stefan Hajnoczi
On Fri, Aug 30, 2013 at 11:42:34AM -0400, Paul Moore wrote: On Friday, August 30, 2013 05:23:45 PM Stefan Hajnoczi wrote: On Fri, Aug 30, 2013 at 4:21 PM, Eduardo Otubo ot...@linux.vnet.ibm.com wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Eduardo Otubo
On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). -netdev

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Eduardo Otubo
On 08/29/2013 05:56 AM, Paolo Bonzini wrote: Il 29/08/2013 10:34, Stefan Hajnoczi ha scritto: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Eduardo Otubo
On 08/29/2013 09:56 AM, Paul Moore wrote: On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). Signed-off-by: Eduardo Otubo

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Paul Moore
On Friday, August 30, 2013 05:23:45 PM Stefan Hajnoczi wrote: On Fri, Aug 30, 2013 at 4:21 PM, Eduardo Otubo ot...@linux.vnet.ibm.com wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Paul Moore
On Friday, August 30, 2013 11:27:28 AM Eduardo Otubo wrote: On 08/29/2013 09:56 AM, Paul Moore wrote: On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Stefan Hajnoczi
On Fri, Aug 30, 2013 at 4:21 PM, Eduardo Otubo ot...@linux.vnet.ibm.com wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-29 Thread Stefan Hajnoczi
On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). -netdev tap,downscript=/path/to/script requires exec() in the QEMU shutdown code path.

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-29 Thread Paolo Bonzini
Il 29/08/2013 10:34, Stefan Hajnoczi ha scritto: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). -netdev

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-29 Thread Paul Moore
On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). Signed-off-by: Eduardo Otubo ot...@linux.vnet.ibm.com We talked about this in a

[Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-28 Thread Eduardo Otubo
Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). Signed-off-by: Eduardo Otubo ot...@linux.vnet.ibm.com --- The second whitelist is installed right before the vcpu starts, it contains all the system