qemu: add an option to enable seccomp
PATCH 1/1 qemu: add an option to enable seccomp
It is required to resume working on the forthcoming libvirt package after a long test period (https://patchwork.ozlabs.org/patch/841613).
Leave it disabled by default, for backward compatibility.
--- package/qemu/Config.in | 13 +++++++++++++ package/qemu/qemu.mk | 8 +++++++- 2 files changed, 20 insertions(+), 1 deletion(-)
package/qemu/Config.in +13 -0
@@ -137,6 +137,19 @@ config BR2_PACKAGE_QEMU_FDT Say 'y' here to have QEMU capable of constructing Device Trees, and passing them to the VMs. +config BR2_PACKAGE_QEMU_SECCOMP + bool "Enable seccomp" + depends on BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS + depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12 + select BR2_PACKAGE_LIBSECCOMP + help + Enable support for the Linux Kernel's syscall filtering + mechanism. + +comment "seccomp needs a toolchain w/ headers >= 3.12" + depends on !BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS || \ + !BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12 + comment "FDT support needs a toolchain w/ dynamic library" depends on BR2_STATIC_LIBS
package/qemu/qemu.mk +7 -1
@@ -55,6 +55,13 @@ endif endif +ifeq ($(BR2_PACKAGE_QEMU_SECCOMP),y) +QEMU_OPTS += --enable-seccomp +QEMU_DEPENDENCIES += libseccomp +else +QEMU_OPTS += --disable-seccomp +endif + # There is no "--enable-slirp" ifeq ($(BR2_PACKAGE_QEMU_SLIRP),) QEMU_OPTS += --disable-slirp
@@ -121,7 +128,6 @@ define QEMU_CONFIGURE_CMDS --disable-libiscsi \ --disable-usb-redir \ --disable-strip \ - --disable-seccomp \ --disable-sparse \ --disable-mpath \ --disable-sanitizers \
Signature · 1 line
2.14.5
PATCH 1/1 qemu: add an option to enable seccomp
Quoted 4 lines
From: "DATACOM" <[email protected]>
To: "buildroot" <[email protected]>
Sent: Ter?a-feira, 20 de novembro de 2018 11:10:42
Subject: [Buildroot] [PATCH] qemu: add an option to enable seccomp
Ops, this is for the "next" branch, not "master".
Signature · 3 lines
Carlos Santos (Casantos) - DATACOM, P&D ?Marched towards the enemy, spear upright, armed with the certainty that only the ignorant can have.? ? Epitaph of a volunteer
PATCH 1/1 qemu: add an option to enable seccomp
In reply to Carlos SantosHello,
Quoted 17 lines · Carlos Santos
It is required to resume working on the forthcoming libvirt package after a long test period (https://patchwork.ozlabs.org/patch/841613).
Leave it disabled by default, for backward compatibility.
Signed-off-by Carlos Santos <[email protected]>--- package/qemu/Config.in | 13 +++++++++++++ package/qemu/qemu.mk | 8 +++++++- 2 files changed, 20 insertions(+), 1 deletion(-)package/qemu/Config.in +0
-0@@ -137,6 +137,19 @@ config BR2_PACKAGE_QEMU_FDT Say 'y' here to have QEMU capable of constructing Device
package/qemu/Config.in config BR2_PACKAGE_QEMU_FDT · line 147
Quoted 10 lines
package/qemu/Config.in +8
-0Trees, and passing them to the VMs. +config BR2_PACKAGE_QEMU_SECCOMP + bool "Enable seccomp" + depends on BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS + depends on BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12 + select BR2_PACKAGE_LIBSECCOMP + help + Enable support for the Linux Kernel's syscall filtering + mechanism.
I don't think we want to introduce an explicit option for this, just enable seccomp support when BR2_PACKAGE_LIBSSECOMP=y.
package/qemu/Config.in config BR2_PACKAGE_QEMU_FDT · line 154
Quoted 6 lines
package/qemu/Config.in +4
-0+comment "seccomp needs a toolchain w/ headers >= 3.12" + depends on !BR2_PACKAGE_LIBSECCOMP_ARCH_SUPPORTS || \ + !BR2_TOOLCHAIN_HEADERS_AT_LEAST_3_12 + comment "FDT support needs a toolchain w/ dynamic library" depends on BR2_STATIC_LIBS
This comment should anyway have remained close to the BR2_PACKAGE_QEMU_FDT option.
Thanks!
Thomas
Signature · 3 lines
Thomas Petazzoni, CTO, Bootlin Embedded Linux and Kernel engineering https://bootlin.com