mirror of
https://github.com/Motorhead1991/qemu.git
synced 2025-08-04 00:03:54 -06:00
73a1e64725
This patch introduces the new argument [,elevateprivileges=allow|deny|children] to the `-sandbox on'. It allows or denies Qemu process to elevate its privileges by blacklisting all set*uid|gid system calls. The 'children' option will let forks and execves run unprivileged. Signed-off-by: Eduardo Otubo <otubo@redhat.com>
25 lines
657 B
C
25 lines
657 B
C
/*
|
|
* QEMU seccomp mode 2 support with libseccomp
|
|
*
|
|
* Copyright IBM, Corp. 2012
|
|
*
|
|
* Authors:
|
|
* Eduardo Otubo <eotubo@br.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*
|
|
* Contributions after 2012-01-13 are licensed under the terms of the
|
|
* GNU GPL, version 2 or (at your option) any later version.
|
|
*/
|
|
#ifndef QEMU_SECCOMP_H
|
|
#define QEMU_SECCOMP_H
|
|
|
|
#define QEMU_SECCOMP_SET_DEFAULT (1 << 0)
|
|
#define QEMU_SECCOMP_SET_OBSOLETE (1 << 1)
|
|
#define QEMU_SECCOMP_SET_PRIVILEGED (1 << 2)
|
|
|
|
#include <seccomp.h>
|
|
|
|
int seccomp_start(uint32_t seccomp_opts);
|
|
#endif
|