commit 24f8cdc5722476e12d8e39d71f66311b4fa971c1
author Eduardo Otubo <otubo@redhat.com> Mon Mar 13 22:18:51 2017 +0100
committer Eduardo Otubo <otubo@redhat.com> Fri Sep 15 10:15:06 2017 +0200
tree 46fd71cfaaa2c1632bfce0d683941c15c84970f1
parent 995a226f880b807e05240e8752d6ce65679775be

seccomp: add resourcecontrol argument to command line

This patch adds [,resourcecontrol=deny] to `-sandbox on' option. It
blacklists all process affinity and scheduler priority system calls to
avoid any bigger of the process.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>

qemu-seccomp.c

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index f3878a5..b770a77 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -82,6 +82,17 @@
     { SCMP_SYS(fork),                   QEMU_SECCOMP_SET_SPAWN },
     { SCMP_SYS(vfork),                  QEMU_SECCOMP_SET_SPAWN },
     { SCMP_SYS(execve),                 QEMU_SECCOMP_SET_SPAWN },
+    /* resource control */
+    { SCMP_SYS(getpriority),            QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_setparam),         QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_getparam),         QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_setscheduler),     QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_getscheduler),     QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_setaffinity),      QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_getaffinity),      QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_get_priority_max), QEMU_SECCOMP_SET_RESOURCECTL },
+    { SCMP_SYS(sched_get_priority_min), QEMU_SECCOMP_SET_RESOURCECTL },
 };