| Message ID | 1457343286-16019-1-git-send-email-mrezanin@redhat.com (mailing list archive) |
|---|---|
| State | New, archived |
| Headers | show |
On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote: > From: Miroslav Rezanina <mrezanin@redhat.com> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > so qemu using rbd image hang after start when run in sandbox mode. > > To allow using rbd images in sandbox mode we have to whitelist it. > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > --- > qemu-seccomp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 2866e3c..e29fca1 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > #ifdef HAVE_CACHEFLUSH > { SCMP_SYS(cacheflush), 240 }, > #endif > + { SCMP_SYS(sysinfo), 240 }, Are you sure you want to add this syscall to the bottom of the list? Did you estimate the frequency it is called by running strace? Thanks for the patch.
----- ??????? ----- > ???: "Eduardo Otubo" <eduardo.otubo@profitbricks.com> > ??: mrezanin@redhat.com > Cc: qemu-devel@nongnu.org, armbru@redhat.com > ????: 2016?3?11?, ??? ?? 9:51:50 > ??: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call > > On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote: > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > so qemu using rbd image hang after start when run in sandbox mode. > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > --- > > qemu-seccomp.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > index 2866e3c..e29fca1 100644 > > --- a/qemu-seccomp.c > > +++ b/qemu-seccomp.c > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall > > seccomp_whitelist[] = { > > #ifdef HAVE_CACHEFLUSH > > { SCMP_SYS(cacheflush), 240 }, > > #endif > > + { SCMP_SYS(sysinfo), 240 }, > > Are you sure you want to add this syscall to the bottom of the list? Did > you estimate the frequency it is called by running strace? > > Thanks for the patch. > Hi, Yes, it wasn't used before nss update and now is used only for rbd based images where it is called just few times upon start so drawback should be minimal. With this we do not change cost of other calls. Thanks for review and question, Mirek > -- > Eduardo Otubo > ProfitBricks GmbH >
On Mon, Mar 21, 2016 at 08=17=45AM -0400, Miroslav Rezanina wrote: > > > ----- ??????? ----- > > ???: "Eduardo Otubo" <eduardo.otubo@profitbricks.com> > > ??: mrezanin@redhat.com > > Cc: qemu-devel@nongnu.org, armbru@redhat.com > > ????: 2016?3?11?, ??? ?? 9:51:50 > > ??: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call > > > > On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote: > > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > > so qemu using rbd image hang after start when run in sandbox mode. > > > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > > --- > > > qemu-seccomp.c | 1 + > > > 1 file changed, 1 insertion(+) > > > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > > index 2866e3c..e29fca1 100644 > > > --- a/qemu-seccomp.c > > > +++ b/qemu-seccomp.c > > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall > > > seccomp_whitelist[] = { > > > #ifdef HAVE_CACHEFLUSH > > > { SCMP_SYS(cacheflush), 240 }, > > > #endif > > > + { SCMP_SYS(sysinfo), 240 }, > > > > Are you sure you want to add this syscall to the bottom of the list? Did > > you estimate the frequency it is called by running strace? > > > > Thanks for the patch. > > > Hi, > > Yes, it wasn't used before nss update and now is used only for rbd based images > where it is called just few times upon start so drawback should be minimal. With > this we do not change cost of other calls. > > Thanks for review and question, > Mirek Ok. So, ACK on this patch. I'll roll out a pull request by the end of the day. Thanks for the contribution.
Quoting mrezanin@redhat.com (mrezanin@redhat.com): > From: Miroslav Rezanina <mrezanin@redhat.com> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > so qemu using rbd image hang after start when run in sandbox mode. > > To allow using rbd images in sandbox mode we have to whitelist it. > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> Thanks. Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> > --- > qemu-seccomp.c | 1 + > 1 file changed, 1 insertion(+) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 2866e3c..e29fca1 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > #ifdef HAVE_CACHEFLUSH > { SCMP_SYS(cacheflush), 240 }, > #endif > + { SCMP_SYS(sysinfo), 240 }, > }; > > int seccomp_start(void) > -- > 2.5.0 > >
On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote: > Quoting mrezanin@redhat.com (mrezanin@redhat.com): > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > so qemu using rbd image hang after start when run in sandbox mode. > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > Thanks. > > Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> Also: I'll change the subject of this email a little bit for a cleaner and more explicit commit. Thanks. > > > --- > > qemu-seccomp.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > index 2866e3c..e29fca1 100644 > > --- a/qemu-seccomp.c > > +++ b/qemu-seccomp.c > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > > #ifdef HAVE_CACHEFLUSH > > { SCMP_SYS(cacheflush), 240 }, > > #endif > > + { SCMP_SYS(sysinfo), 240 }, > > }; > > > > int seccomp_start(void) > > -- > > 2.5.0 > > > > >
----- ??????? ----- > ???: "Eduardo Otubo" <eduardo.otubo@profitbricks.com> > ??: "Serge Hallyn" <serge.hallyn@ubuntu.com> > Cc: mrezanin@redhat.com, qemu-devel@nongnu.org, armbru@redhat.com > ????: 2016?4?12?, ??? ?? 1:53:47 > ??: Re: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call > > On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote: > > Quoting mrezanin@redhat.com (mrezanin@redhat.com): > > > From: Miroslav Rezanina <mrezanin@redhat.com> > > > > > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call > > > so qemu using rbd image hang after start when run in sandbox mode. > > > > > > To allow using rbd images in sandbox mode we have to whitelist it. > > > > > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com> > > > > Thanks. > > > > Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com> > > Also: I'll change the subject of this email a little bit for a cleaner > and more explicit commit. > > Thanks. Ok, thanks. Mirek > > > > > > --- > > > qemu-seccomp.c | 1 + > > > 1 file changed, 1 insertion(+) > > > > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > > index 2866e3c..e29fca1 100644 > > > --- a/qemu-seccomp.c > > > +++ b/qemu-seccomp.c > > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall > > > seccomp_whitelist[] = { > > > #ifdef HAVE_CACHEFLUSH > > > { SCMP_SYS(cacheflush), 240 }, > > > #endif > > > + { SCMP_SYS(sysinfo), 240 }, > > > }; > > > > > > int seccomp_start(void) > > > -- > > > 2.5.0 > > > > > > > > > > -- > Eduardo Otubo > ProfitBricks GmbH >
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 2866e3c..e29fca1 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { #ifdef HAVE_CACHEFLUSH { SCMP_SYS(cacheflush), 240 }, #endif + { SCMP_SYS(sysinfo), 240 }, }; int seccomp_start(void)