[Qemu-commits] [qemu/qemu] e474e3: seccomp: fix killing of whole process instead of t...

[Peter Maydell]

  Branch: refs/heads/master
  Home:   https://github.com/qemu/qemu
  Commit: e474e3aacf4276eb0781d11c45e2fab996f9dc56
      
https://github.com/qemu/qemu/commit/e474e3aacf4276eb0781d11c45e2fab996f9dc56
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   2020-09-15 (Tue, 15 Sep 2020)

  Changed paths:
    M qemu-seccomp.c

  Log Message:
  -----------
  seccomp: fix killing of whole process instead of thread

Back in 2018 we introduced support for killing the whole QEMU process
instead of just one thread, when a seccomp rule is violated:

  commit bda08a5764d470f101fa38635d30b41179a313e1
  Author: Marc-André Lureau <marcandre.lureau@redhat.com>
  Date:   Wed Aug 22 19:02:48 2018 +0200

    seccomp: prefer SCMP_ACT_KILL_PROCESS if available

Fast forward a year and we introduced a patch to avoid killing the
process for resource control syscalls tickled by Mesa.

  commit 9a1565a03b79d80b236bc7cc2dbce52a2ef3a1b8
  Author: Daniel P. Berrangé <berrange@redhat.com>
  Date:   Wed Mar 13 09:49:03 2019 +0000

    seccomp: don't kill process for resource control syscalls

Unfortunately a logic bug effectively reverted the first commit
mentioned so that we go back to only killing the thread, not the whole
process.

Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Acked-by: Eduardo Otubo <otubo@redhat.com>


  Commit: 6c938efc27c2c9c9b02d574d0522a83dc06c72c8
      
https://github.com/qemu/qemu/commit/6c938efc27c2c9c9b02d574d0522a83dc06c72c8
  Author: Peter Maydell <peter.maydell@linaro.org>
  Date:   2020-09-15 (Tue, 15 Sep 2020)

  Changed paths:
    M qemu-seccomp.c

  Log Message:
  -----------
  Merge remote-tracking branch 'remotes/otubo/tags/pull-seccomp-20200915' into 
staging

seccomp branch queue

# gpg: Signature made Tue 15 Sep 2020 11:58:27 BST
# gpg:                using RSA key D67E1B50937486B40723DBABDF32E7C0F0FFF9A2
# gpg:                issuer "otubo@redhat.com"
# gpg: Good signature from "Eduardo Otubo (Senior Software Engineer) 
<otubo@redhat.com>" [full]
# Primary key fingerprint: D67E 1B50 9374 86B4 0723  DBAB DF32 E7C0 F0FF F9A2

* remotes/otubo/tags/pull-seccomp-20200915:
  seccomp: fix killing of whole process instead of thread

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>


Compare: https://github.com/qemu/qemu/compare/9b14671aec0a...6c938efc27c2