Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-28 Thread Yi Min Zhao
在 2018/5/25 下午5:36, Eduardo Otubo 写道: On 05/25/2018 06:23 AM, Yi Min Zhao wrote: 在 2018/5/24 下午9:40, Paolo Bonzini 写道: On 24/05/2018 09:53, Eduardo Otubo wrote: Thanks! But I have not got response from Paolo.  I have added him to CC list.   I'll just wait one more ACK and will send a pu

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-25 Thread Eduardo Otubo
On 05/25/2018 06:23 AM, Yi Min Zhao wrote: 在 2018/5/24 下午9:40, Paolo Bonzini 写道: On 24/05/2018 09:53, Eduardo Otubo wrote: Thanks! But I have not got response from Paolo.  I have added him to CC list.   I'll just wait one more ACK and will send a pull request on the seccomp queue. Thanks fo

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-24 Thread Yi Min Zhao
在 2018/5/24 下午9:40, Paolo Bonzini 写道: On 24/05/2018 09:53, Eduardo Otubo wrote: Thanks! But I have not got response from Paolo.  I have added him to CC list.  I'll just wait one more ACK and will send a pull request on the seccomp queue. Thanks for the contribution. So... what I should d

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-24 Thread Paolo Bonzini
On 24/05/2018 09:53, Eduardo Otubo wrote: > Thanks! But I have not got response from Paolo.  I have added him to CC list. >>>  I'll just wait one more ACK and will send a pull request on the >>> seccomp queue. Thanks for the contribution. >>> >>> >> So... what I should do is wait

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-24 Thread Eduardo Otubo
On 05/23/2018 02:17 PM, Yi Min Zhao wrote: 在 2018/5/23 下午6:33, Eduardo Otubo 写道: On 05/23/2018 11:16 AM, Yi Min Zhao wrote: 在 2018/5/23 下午3:47, Ján Tomko 写道: On Sat, May 19, 2018 at 04:20:37PM +0800, Yi Min Zhao wrote: 在 2018/5/18 下午9:07, Ján Tomko 写道: On Fri, May 18, 2018 at 11:19:16A

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-23 Thread Yi Min Zhao
在 2018/5/23 下午6:33, Eduardo Otubo 写道: On 05/23/2018 11:16 AM, Yi Min Zhao wrote: 在 2018/5/23 下午3:47, Ján Tomko 写道: On Sat, May 19, 2018 at 04:20:37PM +0800, Yi Min Zhao wrote: 在 2018/5/18 下午9:07, Ján Tomko 写道: On Fri, May 18, 2018 at 11:19:16AM +0200, Eduardo Otubo wrote: On 18/05/2018

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-23 Thread Eduardo Otubo
On 05/23/2018 11:16 AM, Yi Min Zhao wrote: 在 2018/5/23 下午3:47, Ján Tomko 写道: On Sat, May 19, 2018 at 04:20:37PM +0800, Yi Min Zhao wrote: 在 2018/5/18 下午9:07, Ján Tomko 写道: On Fri, May 18, 2018 at 11:19:16AM +0200, Eduardo Otubo wrote: On 18/05/2018 - 09:52:12, Ján Tomko wrote: But now li

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-23 Thread Yi Min Zhao
在 2018/5/23 下午3:47, Ján Tomko 写道: On Sat, May 19, 2018 at 04:20:37PM +0800, Yi Min Zhao wrote: 在 2018/5/18 下午9:07, Ján Tomko 写道: On Fri, May 18, 2018 at 11:19:16AM +0200, Eduardo Otubo wrote: On 18/05/2018 - 09:52:12, Ján Tomko wrote: But now libvirt requires QEMU >= 1.5.0 which already s

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-23 Thread Ján Tomko
On Sat, May 19, 2018 at 04:20:37PM +0800, Yi Min Zhao wrote: 在 2018/5/18 下午9:07, Ján Tomko 写道: On Fri, May 18, 2018 at 11:19:16AM +0200, Eduardo Otubo wrote: On 18/05/2018 - 09:52:12, Ján Tomko wrote: But now libvirt requires QEMU >= 1.5.0 which already supports query-command-line-options, s

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-19 Thread Yi Min Zhao
在 2018/5/18 下午9:07, Ján Tomko 写道: On Fri, May 18, 2018 at 11:19:16AM +0200, Eduardo Otubo wrote: On 18/05/2018 - 09:52:12, Ján Tomko wrote: On Thu, May 17, 2018 at 02:41:09PM +0200, Eduardo Otubo wrote: > On 15/05/2018 - 19:33:48, Yi Min Zhao wrote: > > If CONFIG_SECCOMP is undefined, the opt

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-18 Thread Ján Tomko
On Fri, May 18, 2018 at 11:19:16AM +0200, Eduardo Otubo wrote: On 18/05/2018 - 09:52:12, Ján Tomko wrote: On Thu, May 17, 2018 at 02:41:09PM +0200, Eduardo Otubo wrote: > On 15/05/2018 - 19:33:48, Yi Min Zhao wrote: > > If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains > > c

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-18 Thread Eric Blake
On 05/18/2018 02:52 AM, Ján Tomko wrote: This patch fixes the usage of QEMU new enough for seccomp blacklist (where libvirt enables the sandbox by default), but breaks the usage of QEMU with compiled out sandbox and setting  seccomp_sandbox = 0 in libvirt's qemu.conf: error: internal error: pr

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-18 Thread Eduardo Otubo
On 18/05/2018 - 09:52:12, Ján Tomko wrote: > On Thu, May 17, 2018 at 02:41:09PM +0200, Eduardo Otubo wrote: > > On 15/05/2018 - 19:33:48, Yi Min Zhao wrote: > > > If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains > > > compiled. This would make libvirt set the corresponding cap

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-18 Thread Ján Tomko
On Thu, May 17, 2018 at 02:41:09PM +0200, Eduardo Otubo wrote: On 15/05/2018 - 19:33:48, Yi Min Zhao wrote: If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains compiled. This would make libvirt set the corresponding capability and then trigger the guest startup fails. So this

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-17 Thread Yi Min Zhao
在 2018/5/17 下午8:41, Eduardo Otubo 写道: On 15/05/2018 - 19:33:48, Yi Min Zhao wrote: If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains compiled. This would make libvirt set the corresponding capability and then trigger the guest startup fails. So this patch excludes the code

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-17 Thread Eduardo Otubo
On 15/05/2018 - 19:33:48, Yi Min Zhao wrote: > If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains > compiled. This would make libvirt set the corresponding capability and > then trigger the guest startup fails. So this patch excludes the code > regarding seccomp staff if CONFIG_

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-17 Thread Yi Min Zhao
Add Paolo to CC list. @Paolo, expect your comment. Thanks very much! 在 2018/5/15 下午11:25, Eric Blake 写道: On 05/15/2018 06:33 AM, Yi Min Zhao wrote: If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains compiled. This would make libvirt set the corresponding capability and then

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-15 Thread Yi Min Zhao
在 2018/5/15 下午11:25, Eric Blake 写道: On 05/15/2018 06:33 AM, Yi Min Zhao wrote: If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains compiled. This would make libvirt set the corresponding capability and then trigger the guest startup fails. So this patch excludes the code s

Re: [Qemu-devel] [PATCH v2 1/1] sandbox: disable -sandbox if CONFIG_SECCOMP undefined

2018-05-15 Thread Eric Blake
On 05/15/2018 06:33 AM, Yi Min Zhao wrote: If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains compiled. This would make libvirt set the corresponding capability and then trigger the guest startup fails. So this patch excludes the code s/trigger the guest startup fails/trigge