From 5780760f5ea6163939a5dabe7427318b4f07d1a2 Mon Sep 17 00:00:00 2001 From: =?utf8?q?Marc-Andr=C3=A9=20Lureau?= Date: Thu, 30 Aug 2018 16:33:48 +0200 Subject: [PATCH] seccomp: check TSYNC host capability MIME-Version: 1.0 Content-Type: text/plain; charset=utf8 Content-Transfer-Encoding: 8bit Remove -sandbox option if the host is not capable of TSYNC, since the sandbox will fail at setup time otherwise. This will help libvirt, for ex, to figure out if -sandbox will work. Signed-off-by: Marc-André Lureau Signed-off-by: Eduardo Otubo Acked-by: Eduardo Otubo --- qemu-seccomp.c | 19 ++++++++++++++++++- vl.c | 4 ++-- 2 files changed, 20 insertions(+), 3 deletions(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 4729eb107f..1baa5c69ed 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -282,7 +282,24 @@ static QemuOptsList qemu_sandbox_opts = { static void seccomp_register(void) { - qemu_add_opts(&qemu_sandbox_opts); + bool add = false; + + /* FIXME: use seccomp_api_get() >= 2 check when released */ + +#if defined(SECCOMP_FILTER_FLAG_TSYNC) + int check; + + /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */ + check = qemu_seccomp(SECCOMP_SET_MODE_FILTER, + SECCOMP_FILTER_FLAG_TSYNC, NULL); + if (check < 0 && errno == EFAULT) { + add = true; + } +#endif + + if (add) { + qemu_add_opts(&qemu_sandbox_opts); + } } opts_init(seccomp_register); #endif diff --git a/vl.c b/vl.c index 5ba06adf78..380ae7ba2b 100644 --- a/vl.c +++ b/vl.c @@ -4007,8 +4007,8 @@ int main(int argc, char **argv, char **envp) } #ifdef CONFIG_SECCOMP - if (qemu_opts_foreach(qemu_find_opts("sandbox"), - parse_sandbox, NULL, NULL)) { + olist = qemu_find_opts_err("sandbox", NULL); + if (olist && qemu_opts_foreach(olist, parse_sandbox, NULL, NULL)) { exit(1); } #endif -- 2.11.4.GIT