Re: [libvirt] [PATCH] qemu: clear seccomp capability if TSYNC is not supported by host

From: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; With qemu <= 3.0, when using "-seccomp on", the seccomp policy is only applied to the main thread, the vcpu worker thread and other worker threads created after seccomp policy is applied; the seccomp policy is not applied to e.g. the RCU thread because it is created before the seccomp policy is applied. Since qemu commit 70dfabeaa79ba4d7a3b699abe1a047c8012db114 "seccomp: set the seccomp filter to all threads", qemu will require seccomp TSYNC flag, and will fail to start if the flag isn't available. Without it, sandboxing is flawed. Disable seccomp capability if the host is not capable of using seccomp TSYNC.

Signed-off-by: Marc-André Lureau <marcandre.lureau(a)redhat.com&gt; --- configure.ac | 2 +- src/qemu/qemu_capabilities.c | 27 +++++++++++++++++++++++++++ 2 files changed, 28 insertions(+), 1 deletion(-)