yeahuh / rpms / qemu-kvm

Forked from rpms/qemu-kvm 2 years ago
Clone

Blame SOURCES/kvm-seccomp-allow-sched_setscheduler-with-SCHED_IDLE-pol.patch

ae23c9
From a44f33e5cafc02477c182119ee422ea54eb1f3db Mon Sep 17 00:00:00 2001
ae23c9
From: Eduardo Otubo <otubo@redhat.com>
ae23c9
Date: Fri, 28 Sep 2018 07:56:35 +0100
ae23c9
Subject: [PATCH 1/6] seccomp: allow sched_setscheduler() with SCHED_IDLE
ae23c9
 policy
ae23c9
MIME-Version: 1.0
ae23c9
Content-Type: text/plain; charset=UTF-8
ae23c9
Content-Transfer-Encoding: 8bit
ae23c9
ae23c9
RH-Author: Eduardo Otubo <otubo@redhat.com>
ae23c9
Message-id: <20180928075639.16746-2-otubo@redhat.com>
ae23c9
Patchwork-id: 82317
ae23c9
O-Subject: [RHEL-8 qemu-kvm PATCH 1/5] seccomp: allow sched_setscheduler() with SCHED_IDLE policy
ae23c9
Bugzilla: 1618356
ae23c9
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
ae23c9
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
ae23c9
RH-Acked-by: Thomas Huth <thuth@redhat.com>
ae23c9
ae23c9
From: Marc-André Lureau <marcandre.lureau@redhat.com>
ae23c9
ae23c9
commit 056de1e894155fbb99e7b43c1c4382d4920cf437
ae23c9
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
ae23c9
Date:   Tue Jul 10 16:55:57 2018 +0200
ae23c9
ae23c9
    seccomp: allow sched_setscheduler() with SCHED_IDLE policy
ae23c9
ae23c9
    Current and upcoming mesa releases rely on a shader disk cash. It uses
ae23c9
    a thread job queue with low priority, set with
ae23c9
    sched_setscheduler(SCHED_IDLE). However, that syscall is rejected by
ae23c9
    the "resourcecontrol" seccomp qemu filter.
ae23c9
ae23c9
    Since it should be safe to allow lowering thread priority, let's allow
ae23c9
    scheduling thread to idle policy.
ae23c9
ae23c9
    Related to:
ae23c9
    https://bugzilla.redhat.com/show_bug.cgi?id=1594456
ae23c9
ae23c9
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
ae23c9
    Acked-by: Eduardo Otubo <otubo@redhat.com>
ae23c9
ae23c9
Signed-by-off: Eduardo Otubo <otubo@redhat.com>
ae23c9
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
ae23c9
---
ae23c9
 qemu-seccomp.c | 12 ++++++++++--
ae23c9
 1 file changed, 10 insertions(+), 2 deletions(-)
ae23c9
ae23c9
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
ae23c9
index b770a77..845a333 100644
ae23c9
--- a/qemu-seccomp.c
ae23c9
+++ b/qemu-seccomp.c
ae23c9
@@ -29,6 +29,12 @@
ae23c9
 struct QemuSeccompSyscall {
ae23c9
     int32_t num;
ae23c9
     uint8_t set;
ae23c9
+    uint8_t narg;
ae23c9
+    const struct scmp_arg_cmp *arg_cmp;
ae23c9
+};
ae23c9
+
ae23c9
+const struct scmp_arg_cmp sched_setscheduler_arg[] = {
ae23c9
+    SCMP_A1(SCMP_CMP_NE, SCHED_IDLE)
ae23c9
 };
ae23c9
 
ae23c9
 static const struct QemuSeccompSyscall blacklist[] = {
ae23c9
@@ -87,7 +93,8 @@ static const struct QemuSeccompSyscall blacklist[] = {
ae23c9
     { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
     { SCMP_SYS(sched_setparam),         QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
     { SCMP_SYS(sched_getparam),         QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
-    { SCMP_SYS(sched_setscheduler),     QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
+    { SCMP_SYS(sched_setscheduler),     QEMU_SECCOMP_SET_RESOURCECTL,
ae23c9
+      ARRAY_SIZE(sched_setscheduler_arg), sched_setscheduler_arg },
ae23c9
     { SCMP_SYS(sched_getscheduler),     QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
     { SCMP_SYS(sched_setaffinity),      QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
     { SCMP_SYS(sched_getaffinity),      QEMU_SECCOMP_SET_RESOURCECTL },
ae23c9
@@ -113,7 +120,8 @@ int seccomp_start(uint32_t seccomp_opts)
ae23c9
             continue;
ae23c9
         }
ae23c9
 
ae23c9
-        rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, blacklist[i].num, 0);
ae23c9
+        rc = seccomp_rule_add_array(ctx, SCMP_ACT_KILL, blacklist[i].num,
ae23c9
+                                    blacklist[i].narg, blacklist[i].arg_cmp);
ae23c9
         if (rc < 0) {
ae23c9
             goto seccomp_return;
ae23c9
         }
ae23c9
-- 
ae23c9
1.8.3.1
ae23c9