[PATCH 0/5] seccomp: fix hole in blocking forks

[Daniel P . Berrangé]

Blocking the 'fork' syscall on Linux is not sufficient to block the
'fork' C library function, because the latter is essentially always
implemented using the 'clone' syscall these days.

Blocking 'clone' is difficult as that also blocks pthread creation,
so it needs careful filtering.

Daniel P. Berrangé (5):
  seccomp: allow action to be customized per syscall
  seccomp: add unit test for seccomp filtering
  seccomp: fix blocking of process spawning
  seccomp: block use of clone3 syscall
  seccomp: block setns, unshare and execveat syscalls

 MAINTAINERS               |   1 +
 softmmu/qemu-seccomp.c    | 282 +++++++++++++++++++++++++++++---------
 tests/unit/meson.build    |   4 +
 tests/unit/test-seccomp.c | 269 ++++++++++++++++++++++++++++++++++++
 4 files changed, 490 insertions(+), 66 deletions(-)
 create mode 100644 tests/unit/test-seccomp.c

-- 
2.31.1