commit 995a226f880b807e05240e8752d6ce65679775be
author Eduardo Otubo <otubo@redhat.com> Mon Mar 13 22:16:01 2017 +0100
committer Eduardo Otubo <otubo@redhat.com> Fri Sep 15 10:15:06 2017 +0200
tree 52c583395208ab69f6deb0bed685aeb3eefefbe0
parent 73a1e647256b09734ce64ef7a6001a0db03f7106

seccomp: add spawn argument to command line

This patch adds [,spawn=deny] argument to `-sandbox on' option. It
blacklists fork and execve system calls, avoiding Qemu to spawn new
threads or processes.

Signed-off-by: Eduardo Otubo <otubo@redhat.com>

qemu-seccomp.c

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 978d66b..f3878a5 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -78,6 +78,10 @@
     { SCMP_SYS(setresgid),              QEMU_SECCOMP_SET_PRIVILEGED },
     { SCMP_SYS(setfsuid),               QEMU_SECCOMP_SET_PRIVILEGED },
     { SCMP_SYS(setfsgid),               QEMU_SECCOMP_SET_PRIVILEGED },
+    /* spawn */
+    { SCMP_SYS(fork),                   QEMU_SECCOMP_SET_SPAWN },
+    { SCMP_SYS(vfork),                  QEMU_SECCOMP_SET_SPAWN },
+    { SCMP_SYS(execve),                 QEMU_SECCOMP_SET_SPAWN },
 };