Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 09/03/2013 04:05 PM, Eduardo Otubo wrote: On 09/03/2013 03:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right bef

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Paul Moore
On Tuesday, September 03, 2013 05:07:53 PM Eduardo Otubo wrote: > On 09/03/2013 03:21 PM, Paul Moore wrote: > > On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: > >> On 09/03/2013 02:02 PM, Corey Bryant wrote: > >>> On 08/30/2013 10:21 AM, Eduardo Otubo wrote: > On 08/29/2013 05:

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Eduardo Otubo
On 09/03/2013 03:21 PM, Paul Moore wrote: On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Eduardo Otubo
On 09/03/2013 03:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 09/03/2013 02:21 PM, Paul Moore wrote: On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 09/03/2013 02:02 PM, Corey Bryant wrote: On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Paul Moore
On Tuesday, September 03, 2013 02:08:28 PM Corey Bryant wrote: > On 09/03/2013 02:02 PM, Corey Bryant wrote: > > On 08/30/2013 10:21 AM, Eduardo Otubo wrote: > >> On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: > >>> On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: > Now there's a

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-03 Thread Corey Bryant
On 08/30/2013 10:21 AM, Eduardo Otubo wrote: On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and s

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-09-02 Thread Stefan Hajnoczi
On Fri, Aug 30, 2013 at 11:42:34AM -0400, Paul Moore wrote: > On Friday, August 30, 2013 05:23:45 PM Stefan Hajnoczi wrote: > > On Fri, Aug 30, 2013 at 4:21 PM, Eduardo Otubo > wrote: > > > On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: > > >> On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otu

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Stefan Hajnoczi
On Fri, Aug 30, 2013 at 4:21 PM, Eduardo Otubo wrote: > On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: >> On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: >>> >>> Now there's a second whitelist, right before the vcpu starts. The second >>> whitelist is the same as the first one, exce

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Paul Moore
On Friday, August 30, 2013 11:27:28 AM Eduardo Otubo wrote: > On 08/29/2013 09:56 AM, Paul Moore wrote: > > On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: > >> Now there's a second whitelist, right before the vcpu starts. The second > >> whitelist is the same as the first one, excep

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Paul Moore
On Friday, August 30, 2013 05:23:45 PM Stefan Hajnoczi wrote: > On Fri, Aug 30, 2013 at 4:21 PM, Eduardo Otubo wrote: > > On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: > >> On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: > >>> Now there's a second whitelist, right before the vcpu

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Eduardo Otubo
On 08/29/2013 09:56 AM, Paul Moore wrote: On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). Signed-off-by: Eduardo Otubo We talked a

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Eduardo Otubo
On 08/29/2013 05:56 AM, Paolo Bonzini wrote: Il 29/08/2013 10:34, Stefan Hajnoczi ha scritto: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and s

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-30 Thread Eduardo Otubo
On 08/29/2013 05:34 AM, Stefan Hajnoczi wrote: On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). -netdev tap,downscript=/path/to/scrip

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-29 Thread Paul Moore
On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: > Now there's a second whitelist, right before the vcpu starts. The second > whitelist is the same as the first one, except for exec() and select(). > > Signed-off-by: Eduardo Otubo We talked about this in a previous thread, but as a

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-29 Thread Paolo Bonzini
Il 29/08/2013 10:34, Stefan Hajnoczi ha scritto: > On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: >> Now there's a second whitelist, right before the vcpu starts. The second >> whitelist is the same as the first one, except for exec() and select(). > > -netdev tap,downscript=/path/

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-29 Thread Stefan Hajnoczi
On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: > Now there's a second whitelist, right before the vcpu starts. The second > whitelist is the same as the first one, except for exec() and select(). -netdev tap,downscript=/path/to/script requires exec() in the QEMU shutdown code path.

[Qemu-devel] [PATCH] seccomp: adding a second whitelist

2013-08-28 Thread Eduardo Otubo
Now there's a second whitelist, right before the vcpu starts. The second whitelist is the same as the first one, except for exec() and select(). Signed-off-by: Eduardo Otubo --- The second whitelist is installed right before the vcpu starts, it contains all the system calls the first one has exce