cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-seccomp-allow-sched_setscheduler-with-SCHED_IDLE-pol.patch

26ba25
From a44f33e5cafc02477c182119ee422ea54eb1f3db Mon Sep 17 00:00:00 2001
26ba25
From: Eduardo Otubo <otubo@redhat.com>
26ba25
Date: Fri, 28 Sep 2018 07:56:35 +0100
26ba25
Subject: [PATCH 1/6] seccomp: allow sched_setscheduler() with SCHED_IDLE
26ba25
 policy
26ba25
MIME-Version: 1.0
26ba25
Content-Type: text/plain; charset=UTF-8
26ba25
Content-Transfer-Encoding: 8bit
26ba25
26ba25
RH-Author: Eduardo Otubo <otubo@redhat.com>
26ba25
Message-id: <20180928075639.16746-2-otubo@redhat.com>
26ba25
Patchwork-id: 82317
26ba25
O-Subject: [RHEL-8 qemu-kvm PATCH 1/5] seccomp: allow sched_setscheduler() with SCHED_IDLE policy
26ba25
Bugzilla: 1618356
26ba25
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
26ba25
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
RH-Acked-by: Thomas Huth <thuth@redhat.com>
26ba25
26ba25
From: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
26ba25
commit 056de1e894155fbb99e7b43c1c4382d4920cf437
26ba25
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
Date:   Tue Jul 10 16:55:57 2018 +0200
26ba25
26ba25
    seccomp: allow sched_setscheduler() with SCHED_IDLE policy
26ba25
26ba25
    Current and upcoming mesa releases rely on a shader disk cash. It uses
26ba25
    a thread job queue with low priority, set with
26ba25
    sched_setscheduler(SCHED_IDLE). However, that syscall is rejected by
26ba25
    the "resourcecontrol" seccomp qemu filter.
26ba25
26ba25
    Since it should be safe to allow lowering thread priority, let's allow
26ba25
    scheduling thread to idle policy.
26ba25
26ba25
    Related to:
26ba25
    https://bugzilla.redhat.com/show_bug.cgi?id=1594456
26ba25
26ba25
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
    Acked-by: Eduardo Otubo <otubo@redhat.com>
26ba25
26ba25
Signed-by-off: Eduardo Otubo <otubo@redhat.com>
26ba25
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
26ba25
---
26ba25
 qemu-seccomp.c | 12 ++++++++++--
26ba25
 1 file changed, 10 insertions(+), 2 deletions(-)
26ba25
26ba25
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
26ba25
index b770a77..845a333 100644
26ba25
--- a/qemu-seccomp.c
26ba25
+++ b/qemu-seccomp.c
26ba25
@@ -29,6 +29,12 @@
26ba25
 struct QemuSeccompSyscall {
26ba25
     int32_t num;
26ba25
     uint8_t set;
26ba25
+    uint8_t narg;
26ba25
+    const struct scmp_arg_cmp *arg_cmp;
26ba25
+};
26ba25
+
26ba25
+const struct scmp_arg_cmp sched_setscheduler_arg[] = {
26ba25
+    SCMP_A1(SCMP_CMP_NE, SCHED_IDLE)
26ba25
 };
26ba25
 
26ba25
 static const struct QemuSeccompSyscall blacklist[] = {
26ba25
@@ -87,7 +93,8 @@ static const struct QemuSeccompSyscall blacklist[] = {
26ba25
     { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
     { SCMP_SYS(sched_setparam),         QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
     { SCMP_SYS(sched_getparam),         QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
-    { SCMP_SYS(sched_setscheduler),     QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
+    { SCMP_SYS(sched_setscheduler),     QEMU_SECCOMP_SET_RESOURCECTL,
26ba25
+      ARRAY_SIZE(sched_setscheduler_arg), sched_setscheduler_arg },
26ba25
     { SCMP_SYS(sched_getscheduler),     QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
     { SCMP_SYS(sched_setaffinity),      QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
     { SCMP_SYS(sched_getaffinity),      QEMU_SECCOMP_SET_RESOURCECTL },
26ba25
@@ -113,7 +120,8 @@ int seccomp_start(uint32_t seccomp_opts)
26ba25
             continue;
26ba25
         }
26ba25
 
26ba25
-        rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, blacklist[i].num, 0);
26ba25
+        rc = seccomp_rule_add_array(ctx, SCMP_ACT_KILL, blacklist[i].num,
26ba25
+                                    blacklist[i].narg, blacklist[i].arg_cmp);
26ba25
         if (rc < 0) {
26ba25
             goto seccomp_return;
26ba25
         }
26ba25
-- 
26ba25
1.8.3.1
26ba25