[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCHv6 3/5] seccomp: add elevateprivileges argument t
From: |
Thomas Huth |
Subject: |
Re: [Qemu-devel] [PATCHv6 3/5] seccomp: add elevateprivileges argument to command line |
Date: |
Fri, 8 Sep 2017 15:12:54 +0200 |
User-agent: |
Mozilla/5.0 (X11; Linux x86_64; rv:52.0) Gecko/20100101 Thunderbird/52.3.0 |
On 08.09.2017 13:44, Eduardo Otubo wrote:
> This patch introduces the new argument
> [,elevateprivileges=allow|deny|children] to the `-sandbox on'. It allows
> or denies Qemu process to elevate its privileges by blacklisting all
> set*uid|gid system calls. The 'children' option will let forks and
> execves run unprivileged.
>
> Signed-off-by: Eduardo Otubo <address@hidden>
> ---
> include/sysemu/seccomp.h | 1 +
> qemu-options.hx | 12 +++++++++---
> qemu-seccomp.c | 11 +++++++++++
> vl.c | 27 +++++++++++++++++++++++++++
> 4 files changed, 48 insertions(+), 3 deletions(-)
Reviewed-by: Thomas Huth <address@hidden>
- [Qemu-devel] [PATCHv6 0/6] seccomp: feature refactoring, Eduardo Otubo, 2017/09/08
- [Qemu-devel] [PATCHv6 1/5] seccomp: changing from whitelist to blacklist, Eduardo Otubo, 2017/09/08
- [Qemu-devel] [PATCHv6 2/5] seccomp: add obsolete argument to command line, Eduardo Otubo, 2017/09/08
- [Qemu-devel] [PATCHv6 3/5] seccomp: add elevateprivileges argument to command line, Eduardo Otubo, 2017/09/08
- [Qemu-devel] [PATCHv6 4/5] seccomp: add spawn argument to command line, Eduardo Otubo, 2017/09/08
- [Qemu-devel] [PATCHv6 5/5] seccomp: add resourcecontrol argument to command line, Eduardo Otubo, 2017/09/08
- Re: [Qemu-devel] [PATCHv6 0/6] seccomp: feature refactoring, Eduardo Otubo, 2017/09/14