diff options
Diffstat (limited to 'qemu/qemu-seccomp.c')
| -rw-r--r-- | qemu/qemu-seccomp.c | 19 |
1 files changed, 17 insertions, 2 deletions
diff --git a/qemu/qemu-seccomp.c b/qemu/qemu-seccomp.c index f9de0d339..cb569dc05 100644 --- a/qemu/qemu-seccomp.c +++ b/qemu/qemu-seccomp.c @@ -12,10 +12,20 @@ * Contributions after 2012-01-13 are licensed under the terms of the * GNU GPL, version 2 or (at your option) any later version. */ -#include <stdio.h> +#include "qemu/osdep.h" #include <seccomp.h> #include "sysemu/seccomp.h" +/* For some architectures (notably ARM) cacheflush is not supported until + * libseccomp 2.2.3, but configure enforces that we are using a more recent + * version on those hosts, so it is OK for this check to be less strict. + */ +#if SCMP_VER_MAJOR >= 3 + #define HAVE_CACHEFLUSH +#elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 2 + #define HAVE_CACHEFLUSH +#endif + struct QemuSeccompSyscall { int32_t num; uint8_t priority; @@ -237,7 +247,12 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(fadvise64), 240 }, { SCMP_SYS(inotify_init1), 240 }, { SCMP_SYS(inotify_add_watch), 240 }, - { SCMP_SYS(mbind), 240 } + { SCMP_SYS(mbind), 240 }, + { SCMP_SYS(memfd_create), 240 }, +#ifdef HAVE_CACHEFLUSH + { SCMP_SYS(cacheflush), 240 }, +#endif + { SCMP_SYS(sysinfo), 240 }, }; int seccomp_start(void) |