aboutsummaryrefslogtreecommitdiff
path: root/qemu-options.hx
diff options
context:
space:
mode:
authorEduardo Otubo <otubo@redhat.com>2017-03-13 22:13:27 +0100
committerEduardo Otubo <otubo@redhat.com>2017-09-15 10:15:06 +0200
commit73a1e647256b09734ce64ef7a6001a0db03f7106 (patch)
tree522eda09d8df57747caf6acc9ecd4b3a61e4ecc3 /qemu-options.hx
parent2b716fa6d63a183a42b789595c3944f53c0ded7c (diff)
downloadqemu-73a1e647256b09734ce64ef7a6001a0db03f7106.zip
qemu-73a1e647256b09734ce64ef7a6001a0db03f7106.tar.gz
qemu-73a1e647256b09734ce64ef7a6001a0db03f7106.tar.bz2
seccomp: add elevateprivileges argument to command line
This patch introduces the new argument [,elevateprivileges=allow|deny|children] to the `-sandbox on'. It allows or denies Qemu process to elevate its privileges by blacklisting all set*uid|gid system calls. The 'children' option will let forks and execves run unprivileged. Signed-off-by: Eduardo Otubo <otubo@redhat.com>
Diffstat (limited to 'qemu-options.hx')
-rw-r--r--qemu-options.hx12
1 files changed, 9 insertions, 3 deletions
diff --git a/qemu-options.hx b/qemu-options.hx
index 72150c6..5c1b163 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -4017,20 +4017,26 @@ Old param mode (ARM only).
ETEXI
DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
- "-sandbox on[,obsolete=allow|deny]\n" \
+ "-sandbox on[,obsolete=allow|deny][,elevateprivileges=allow|deny|children]\n" \
" Enable seccomp mode 2 system call filter (default 'off').\n" \
" use 'obsolete' to allow obsolete system calls that are provided\n" \
" by the kernel, but typically no longer used by modern\n" \
- " C library implementations.\n",
+ " C library implementations.\n" \
+ " use 'elevateprivileges' to allow or deny QEMU process to elevate\n" \
+ " its privileges by blacklisting all set*uid|gid system calls.\n" \
+ " The value 'children' will deny set*uid|gid system calls for\n" \
+ " main QEMU process but will allow forks and execves to run unprivileged\n",
QEMU_ARCH_ALL)
STEXI
-@item -sandbox @var{arg}[,obsolete=@var{string}]
+@item -sandbox @var{arg}[,obsolete=@var{string}][,elevateprivileges=@var{string}]
@findex -sandbox
Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will
disable it. The default is 'off'.
@table @option
@item obsolete=@var{string}
Enable Obsolete system calls
+@item elevateprivileges=@var{string}
+Disable set*uid|gid system calls
@end table
ETEXI