From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:54304) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SrDK1-0004nG-U2 for qemu-devel@nongnu.org; Tue, 17 Jul 2012 15:20:38 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SrDK0-0002br-QV for qemu-devel@nongnu.org; Tue, 17 Jul 2012 15:20:37 -0400 Received: from e24smtp05.br.ibm.com ([32.104.18.26]:41800) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SrDK0-0002ba-Du for qemu-devel@nongnu.org; Tue, 17 Jul 2012 15:20:36 -0400 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 17 Jul 2012 16:20:35 -0300 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp02.br.ibm.com (Postfix) with ESMTP id 46BAD1DC004B for ; Tue, 17 Jul 2012 15:20:32 -0400 (EDT) Received: from d24av05.br.ibm.com (d24av05.br.ibm.com [9.18.232.44]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q6HJHBEf3182828 for ; Tue, 17 Jul 2012 16:17:11 -0300 Received: from d24av05.br.ibm.com (loopback [127.0.0.1]) by d24av05.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q6HJKUFa013783 for ; Tue, 17 Jul 2012 16:20:31 -0300 From: Eduardo Otubo Date: Tue, 17 Jul 2012 16:19:15 -0300 Message-Id: <98962f4d0fbdbc4363b813c8e18072eb7628bf48.1342552002.git.otubo@linux.vnet.ibm.com> In-Reply-To: References: In-Reply-To: References: Subject: [Qemu-devel] [PATCHv4 4/4] Adding seccomp calls to vl.c List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, blauwirbel@gmail.com, anthony@codemonkey.ws, wad@chromium.org, Eduardo Otubo v1: * Full seccomp calls and data included in vl.c v2: * Full seccomp calls and data removed from vl.c and put into separate qemu-seccomp.[ch] file. v4: * Call to install_seccomp_syscall_debug() added. * Now calling seccomp_start() with 'SECCOMP_MODE' argument, depending on settings used in configure script. Signed-off-by: Eduardo Otubo --- vl.c | 31 +++++++++++++++++++++++++++++++ 1 file changed, 31 insertions(+) diff --git a/vl.c b/vl.c index 46248b9..8dc9432 100644 --- a/vl.c +++ b/vl.c @@ -62,6 +62,14 @@ #include #include #endif + +#ifdef CONFIG_SECCOMP +#include "qemu-seccomp.h" +#endif +#ifdef CONFIG_SECCOMP_DEBUG +#include "qemu-seccomp-debug.h" +#endif + #ifdef __sun__ #include #include @@ -169,6 +177,14 @@ int main(int argc, char **argv) #define MAX_VIRTIO_CONSOLES 1 +#ifdef CONFIG_SECCOMP +#ifdef CONFIG_SECCOMP_DEBUG +#define SECCOMP_MODE SCMP_ACT_TRAP +#else +#define SECCOMP_MODE SCMP_ACT_KILL +#endif +#endif + static const char *data_dir; const char *bios_name = NULL; enum vga_retrace_method vga_retrace_method = VGA_RETRACE_DUMB; @@ -2295,6 +2311,21 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; +#ifdef CONFIG_SECCOMP_DEBUG + if (install_seccomp_syscall_debug()) { + fprintf(stderr, "seccomp: failed to install system call debug\n"); + exit(1); + } +#endif + +#ifdef CONFIG_SECCOMP + if (seccomp_start(SECCOMP_MODE) < 0) { + fprintf(stderr, + "seccomp: failed to install syscall filter in the kernel\n"); + exit(1); + } +#endif + atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]); -- 1.7.9.5