From a5d14facb1e4ef354b0a819e159e5f4564fbd15e Mon Sep 17 00:00:00 2001 From: Paul Moore <pmoore@redhat.com> Date: Wed, 29 May 2013 16:30:01 -0400 Subject: [PATCH] seccomp: add the asynchronous I/O syscalls to the whitelist In order to enable the asynchronous I/O functionality when using the seccomp sandbox we need to add the associated syscalls to the whitelist. Signed-off-by: Paul Moore <pmoore@redhat.com> Reviewed-by: Corey Bryant <coreyb@linux.vnet.ibm.com> Message-id: 20130529203001.20939.83322.stgit@localhost Signed-off-by: Anthony Liguori <aliguori@us.ibm.com> (cherry picked from commit fd21faadb12669e24eaf0a277de61c24fcde4cac) Signed-off-by: Michael Roth <mdroth@linux.vnet.ibm.com> --- qemu-seccomp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 031da1dfee..ca123bfeba 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -87,6 +87,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(stat), 245 }, { SCMP_SYS(uname), 245 }, { SCMP_SYS(eventfd2), 245 }, + { SCMP_SYS(io_getevents), 245 }, { SCMP_SYS(dup), 245 }, { SCMP_SYS(dup2), 245 }, { SCMP_SYS(dup3), 245 }, @@ -229,7 +230,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(sendmmsg), 241 }, { SCMP_SYS(recvmmsg), 241 }, { SCMP_SYS(prlimit64), 241 }, - { SCMP_SYS(waitid), 241 } + { SCMP_SYS(waitid), 241 }, + { SCMP_SYS(io_setup), 241 }, + { SCMP_SYS(io_destroy), 241 } }; int seccomp_start(void) -- 2.49.0