Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Miroslav Rezanina]

----- 元のメッセージ -----
> 差出人: "Eduardo Otubo" <address@hidden>
> 宛先: address@hidden
> Cc: address@hidden, address@hidden
> 送信済み: 2016年3月11日, 金曜日 午前 9:51:50
> 件名: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> 
> On Mon, Mar 07, 2016 at 10=34=46AM +0100, address@hidden wrote:
> > From: Miroslav Rezanina <address@hidden>
> > 
> > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > so qemu using rbd image hang after start when run in sandbox mode.
> > 
> > To allow using rbd images in sandbox mode we have to whitelist it.
> > 
> > Signed-off-by: Miroslav Rezanina <address@hidden>
> > ---
> >  qemu-seccomp.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 2866e3c..e29fca1 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = {
> >  #ifdef HAVE_CACHEFLUSH
> >      { SCMP_SYS(cacheflush), 240 },
> >  #endif
> > +    { SCMP_SYS(sysinfo), 240 },
> 
> Are you sure you want to add this syscall to the bottom of the list? Did
> you estimate the frequency it is called by running strace?
> 
> Thanks for the patch.
> 
Hi,

Yes, it wasn't used before nss update and now is used only for rbd based images
where it is called just few times upon start so drawback should be minimal. With
this we do not change cost of other calls.

Thanks for review and question,
Mirek

> --
> Eduardo Otubo
> ProfitBricks GmbH
> 

-- 
Miroslav Rezanina
Software Engineer - Virtualization Team