From 2b34fb6fdd65055bb38f53312542a1ea7ecbed2e Mon Sep 17 00:00:00 2001 From: Paul Moore Date: Thu, 11 Sep 2014 03:16:56 +0200 Subject: [PATCH 1/6] seccomp: add semctl() to the syscall whitelist Message-id: <20140911031656.11035.52808.stgit@localhost> Patchwork-id: 60971 O-Subject: [RHEL7 qemu-kvm PATCH] seccomp: add semctl() to the syscall whitelist Bugzilla: 1026314 RH-Acked-by: Miroslav Rezanina RH-Acked-by: Stefan Hajnoczi RH-Acked-by: Laszlo Ersek commit b22876cc2f863c58cfebd4a5301fc47e8ec89228 Author: Paul Moore Date: Thu Aug 14 13:19:32 2014 -0400 seccomp: add semctl() to the syscall whitelist QEMU needs to call semctl() for correct operation. This particular problem was identified on shutdown with the following commandline: # qemu -sandbox on -monitor stdio \ -device intel-hda -device hda-duplex -vnc :0 Signed-off-by: Paul Moore Signed-off-by: Eduardo Otubo Signed-off-by: Miroslav Rezanina --- qemu-seccomp.c | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index cca1070..59cae8e 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -245,7 +245,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(shmdt), 240 }, { SCMP_SYS(shmctl), 240 }, { SCMP_SYS(mlock), 240 }, - { SCMP_SYS(munlock), 240 } + { SCMP_SYS(munlock), 240 }, + { SCMP_SYS(semctl), 240 } }; int seccomp_start(void) -- 1.8.3.1