• Eduardo Otubo's avatar
    Adding qemu-seccomp.[ch] (v8) · 2f668be7
    Eduardo Otubo authored
    Signed-off-by: default avatarEduardo Otubo <otubo@linux.vnet.ibm.com>
    Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
    ---
    v1:
     - I added a syscall struct using priority levels as described in the
       libseccomp man page. The priority numbers are based to the frequency
       they appear in a sample strace from a regular qemu guest run under
       libvirt.
    
       Libseccomp generates linear BPF code to filter system calls, those rules
       are read one after another. The priority system places the most common
       rules first in order to reduce the overhead when processing them.
    
    v1 -> v2:
     - Fixed some style issues
     - Removed code from vl.c and created qemu-seccomp.[ch]
     - Now using ARRAY_SIZE macro
     - Added more syscalls without priority/frequency set yet
    
    v2 -> v3:
     - Adding copyright and license information
     - Replacing seccomp_whitelist_count just by ARRAY_SIZE
     - Adding header protection to qemu-seccomp.h
     - Moving QemuSeccompSyscall definition to qemu-seccomp.c
     - Negative return from seccomp_start is fatal now.
     - Adding open() and execve() to the whitelis
    
    v3 -> v4:
     - Tests revealed a bigger set of syscalls.
     - seccomp_start() now has an argument to set the mode according to the
       configure option trap or kill.
    
    v4 -> v5:
     - Tests on x86_64 required a new specific set of system calls.
     - libseccomp release 1.0.0: part of the API have changed in this last
       release, had to adapt to the new function signatures.
    2f668be7
qemu-seccomp.c 3.99 KB