File 0045-sandbox-disable-sandbox-if-CONFIG_S.patch of Package qemu

Overview Repositories Revisions Requests Users Attributes Meta

File 0045-sandbox-disable-sandbox-if-CONFIG_S.patch of Package qemu (Revision 95b278d20ec699048440c083f804d4a7)

Currently displaying revision 95b278d20ec699048440c083f804d4a7 , Show latest

From b481a5487b92fa40b74d8bf8c786a35d09eb97cd Mon Sep 17 00:00:00 2001
From: Yi Min Zhao <zyimin@linux.ibm.com>
Date: Thu, 31 May 2018 11:29:37 +0800
Subject: [PATCH] sandbox: disable -sandbox if CONFIG_SECCOMP undefined
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

If CONFIG_SECCOMP is undefined, the option 'elevatedprivileges' remains
compiled. This would make libvirt set the corresponding capability and
then trigger failure during guest startup. This patch moves the code
regarding seccomp command line options to qemu-seccomp.c file and
wraps qemu_opts_foreach finding sandbox option with CONFIG_SECCOMP.
Because parse_sandbox() is moved into qemu-seccomp.c file, change
seccomp_start() to static function.

Signed-off-by: Yi Min Zhao <zyimin@linux.ibm.com>
Reviewed-by: Ján Tomko <jtomko@redhat.com>
Tested-by: Ján Tomko <jtomko@redhat.com>
Acked-by: Eduardo Otubo <otubo@redhat.com>
(cherry picked from commit 9d0fdecbad130f01b602e35e87c6d3fad5821d6e)
[LD: BSC#1106222 CVE-2018-15746]
Signed-off-by: Larry Dewey <ldewey@suse.com>
---
 qemu-seccomp.c | 1 -
 1 file changed, 1 deletion(-)

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 4729eb107f..5507d9c4ef 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -135,7 +135,6 @@ static uint32_t qemu_seccomp_get_kill_action(void)
     return SCMP_ACT_TRAP;
 }
 
-
 static int seccomp_start(uint32_t seccomp_opts)
 {
     int rc = 0;

Places

File 0045-sandbox-disable-sandbox-if-CONFIG_S.patch of Package qemu (Revision 95b278d20ec699048440c083f804d4a7)

Places