Re: [Qemu-devel] [PATCHv6 3/5] seccomp: add elevateprivileges argument to command line

[Daniel P. Berrange]

On Fri, Sep 08, 2017 at 01:44:05PM +0200, Eduardo Otubo wrote:
> This patch introduces the new argument
> [,elevateprivileges=allow|deny|children] to the `-sandbox on'. It allows
> or denies Qemu process to elevate its privileges by blacklisting all
> set*uid|gid system calls. The 'children' option will let forks and
> execves run unprivileged.
> 
> Signed-off-by: Eduardo Otubo <address@hidden>
> ---
>  include/sysemu/seccomp.h |  1 +
>  qemu-options.hx          | 12 +++++++++---
>  qemu-seccomp.c           | 11 +++++++++++
>  vl.c                     | 27 +++++++++++++++++++++++++++
>  4 files changed, 48 insertions(+), 3 deletions(-)

Reviewed-by: Daniel P. Berrange <address@hidden>


Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|