motorhead/qemu
1
0
Fork 0
mirror of https://github.com/Motorhead1991/qemu.git synced 2025-08-04 16:23:55 -06:00
Code Issues Projects Releases Packages Wiki Activity Actions

sandbox: disable -sandbox if CONFIG_SECCOMP undefined

Browse source 
If CONFIG_SECCOMP is undefined, the option 'elevatedprivileges' remains
compiled. This would make libvirt set the corresponding capability and
then trigger failure during guest startup. This patch moves the code
regarding seccomp command line options to qemu-seccomp.c file and
wraps qemu_opts_foreach finding sandbox option with CONFIG_SECCOMP.
Because parse_sandbox() is moved into qemu-seccomp.c file, change
seccomp_start() to static function.

Signed-off-by: Yi Min Zhao <zyimin@linux.ibm.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Tested-by: Ján Tomko <jtomko@redhat.com>
Acked-by: Eduardo Otubo <otubo@redhat.com>
This commit is contained in:
Yi Min Zhao 2018-05-31 11:29:37 +08:00 • committed by Eduardo Otubo
parent 14fc618461
commit 9d0fdecbad
3 changed files with 130 additions and 118 deletions
Download patch file Download diff file Expand all files Collapse all files

3
include/sysemu/seccomp.h
View file

@ -21,5 +21,6 @@
#define QEMU_SECCOMP_SET_SPAWN (1 << 3)
#define QEMU_SECCOMP_SET_RESOURCECTL (1 << 4)
int seccomp_start(uint32_t seccomp_opts);
int parse_sandbox(void *opaque, QemuOpts *opts, Error **errp);
#endif