QEMU has a `sandbox` feature, wherein it will use seccomp2 to restrict what system calls it is able to make.
Suggested-by: Ross Lagerwall <ross.lagerw...@citrix.com> Signed-off-by: George Dunlap <george.dun...@citrix.com> --- This can't be checked in as-is, because `-sandbox` support may not have been compiled in. We therefore need to either: 1. Require that this feature be enabled to build qemu 2. Check for `-sandbox` support at runtime before CC: Ian Jackson <ian.jack...@citrix.com> CC: Wei Liu <wei.l...@citrix.com> CC: Anthony Perard <anthony.per...@citrix.com> CC: Stefano Stabellini <sstabell...@kernel.org> --- tools/libxl/libxl_dm.c | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/tools/libxl/libxl_dm.c b/tools/libxl/libxl_dm.c index 6733514370..b541c1a55e 100644 --- a/tools/libxl/libxl_dm.c +++ b/tools/libxl/libxl_dm.c @@ -1448,6 +1448,10 @@ static int libxl__build_device_model_args_new(libxl__gc *gc, // Add "-chroot [dir]" to command-line flexarray_append(dm_args, "-chroot"); flexarray_append(dm_args, chroot_dir); + + // Add sandboxing + flexarray_append(dm_args, "-sandbox"); + flexarray_append(dm_args, "on,obsolete=deny,elevateprivileges=allow,spawn=deny,resourcecontrol=deny"); } if (state->saved_state) { -- 2.18.0 _______________________________________________ Xen-devel mailing list Xen-devel@lists.xenproject.org https://lists.xenproject.org/mailman/listinfo/xen-devel