Searched hist:e79f8b8b (Results 1 – 1 of 1) sorted by relevance
/qemu/system/ |
H A D | qemu-seccomp.c | e79f8b8b Wed Jan 31 17:02:15 GMT 2024 Daniel P. Berrangé <berrange@redhat.com> seccomp: report EPERM instead of killing process for spawn set
When something tries to run one of the spawn syscalls (eg clone), our seccomp deny filter is set to cause a fatal trap which kills the process.
This is found to be unhelpful when QEMU has loaded the nvidia GL library. This tries to spawn a process to modprobe the nvidia kmod. This is a dubious thing to do, but at the same time, the code will gracefully continue if this fails. Our seccomp filter rightly blocks the spawning, but prevent the graceful continue.
Switching to reporting EPERM will make QEMU behave more gracefully without impacting the level of protect we have.
https://gitlab.com/qemu-project/qemu/-/issues/2116 Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
|