cryptospore / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-seccomp-fix-killing-of-whole-process-instead-of-thre.patch

58d4fd
From 2edf1c3a2ee65ef0e4f6bd4f8de650e529f5481d Mon Sep 17 00:00:00 2001
58d4fd
From: Eduardo Otubo <otubo@redhat.com>
58d4fd
Date: Tue, 15 Sep 2020 15:15:49 -0400
58d4fd
Subject: [PATCH] seccomp: fix killing of whole process instead of thread
58d4fd
MIME-Version: 1.0
58d4fd
Content-Type: text/plain; charset=UTF-8
58d4fd
Content-Transfer-Encoding: 8bit
58d4fd
58d4fd
RH-Author: Eduardo Otubo <otubo@redhat.com>
58d4fd
Message-id: <20200915151549.5007-1-otubo@redhat.com>
58d4fd
Patchwork-id: 98392
58d4fd
O-Subject: [RHEL-AV-8.3.0/RHEL-8.3.0 qemu-kvm PATCH] seccomp: fix killing of whole process instead of thread
58d4fd
Bugzilla: 1890885
58d4fd
RH-Acked-by: Stefan Hajnoczi <stefanha@redhat.com>
58d4fd
RH-Acked-by: Laszlo Ersek <lersek@redhat.com>
58d4fd
RH-Acked-by: Daniel P. Berrange <berrange@redhat.com>
58d4fd
58d4fd
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1752376
58d4fd
BRANCH: rhel-av-8.3.0
58d4fd
UPSTREAM: Merged
58d4fd
BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=31339152
58d4fd
58d4fd
BZ: https://bugzilla.redhat.com/show_bug.cgi?id=1752376
58d4fd
BRANCH: rhel-8.3.0
58d4fd
UPSTREAM: Merged
58d4fd
BREW: https://brewweb.engineering.redhat.com/brew/taskinfo?taskID=31339111
58d4fd
58d4fd
From: Daniel P. Berrangé <berrange@redhat.com>
58d4fd
58d4fd
Back in 2018 we introduced support for killing the whole QEMU process
58d4fd
instead of just one thread, when a seccomp rule is violated:
58d4fd
58d4fd
  commit bda08a5764d470f101fa38635d30b41179a313e1
58d4fd
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
58d4fd
  Date:   Wed Aug 22 19:02:48 2018 +0200
58d4fd
58d4fd
    seccomp: prefer SCMP_ACT_KILL_PROCESS if available
58d4fd
58d4fd
Fast forward a year and we introduced a patch to avoid killing the
58d4fd
process for resource control syscalls tickled by Mesa.
58d4fd
58d4fd
  commit 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8
58d4fd
  Author: Daniel P. Berrangé <berrange@redhat.com>
58d4fd
  Date:   Wed Mar 13 09:49:03 2019 +0000
58d4fd
58d4fd
    seccomp: don't kill process for resource control syscalls
58d4fd
58d4fd
Unfortunately a logic bug effectively reverted the first commit
58d4fd
mentioned so that we go back to only killing the thread, not the whole
58d4fd
process.
58d4fd
58d4fd
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
58d4fd
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
58d4fd
Acked-by: Eduardo Otubo <otubo@redhat.com>
58d4fd
(cherry picked from commit e474e3aacf4276eb0781d11c45e2fab996f9dc56)
58d4fd
Signed-off-by: Eduardo Otubo <otubo@redhat.com>
58d4fd
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
58d4fd
---
58d4fd
 qemu-seccomp.c | 3 ++-
58d4fd
 1 file changed, 2 insertions(+), 1 deletion(-)
58d4fd
58d4fd
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
58d4fd
index e0a1829b3dd..8325ecb766e 100644
58d4fd
--- a/qemu-seccomp.c
58d4fd
+++ b/qemu-seccomp.c
58d4fd
@@ -136,8 +136,9 @@ static uint32_t qemu_seccomp_get_action(int set)
58d4fd
 
58d4fd
             if (qemu_seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0) {
58d4fd
                 kill_process = 1;
58d4fd
+            } else {
58d4fd
+                kill_process = 0;
58d4fd
             }
58d4fd
-            kill_process = 0;
58d4fd
         }
58d4fd
         if (kill_process == 1) {
58d4fd
             return SCMP_ACT_KILL_PROCESS;
58d4fd
-- 
58d4fd
2.27.0
58d4fd