On Fri, Jan 28, 2022 at 4:42 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> Hi Eduardo,
>
> You acked this series, but going through my old git branches I
> just discovered that this never got merged. I guess I was assuming
> you had queued it for a future PULL when you acked it.
>
> I don't mind sending a pull request myself if you've no objections.
I don't mind at all. Thanks for letting me know! I might have missed it somehow.
Thank you!
>
> On Wed, Aug 04, 2021 at 10:05:38AM +0200, Eduardo Terrell Ferrari Otubo wrote:
> > On Mon, 2021-08-02 at 14:02 +0100, Daniel P. Berrangé wrote:
> > > Blocking the 'fork' syscall on Linux is not sufficient to block the
> > > 'fork' C library function, because the latter is essentially always
> > > implemented using the 'clone' syscall these days.
> > >
> > > Blocking 'clone' is difficult as that also blocks pthread creation,
> > > so it needs careful filtering.
> > >
> > > Daniel P. Berrangé (5):
> > > seccomp: allow action to be customized per syscall
> > > seccomp: add unit test for seccomp filtering
> > > seccomp: fix blocking of process spawning
> > > seccomp: block use of clone3 syscall
> > > seccomp: block setns, unshare and execveat syscalls
> > >
> > > MAINTAINERS | 1 +
> > > softmmu/qemu-seccomp.c | 282 +++++++++++++++++++++++++++++-------
> > > --
> > > tests/unit/meson.build | 4 +
> > > tests/unit/test-seccomp.c | 269 ++++++++++++++++++++++++++++++++++++
> > > 4 files changed, 490 insertions(+), 66 deletions(-)
> > > create mode 100644 tests/unit/test-seccomp.c
> > >
> > > --
> > > 2.31.1
> > >
> > >
> >
> > Acked-by: Eduardo Otubo <otubo@redhat.com>
> >
> > --
> > Eduardo Otubo
> >
> >
>
>
>
> Regards,
> Daniel
> --
> |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
> |: https://libvirt.org -o- https://fstop138.berrange.com :|
> |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
>