From 2fe5ad76cd75f41f01cc343a1abe953d90ea3df9 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Fri, 23 Feb 2024 12:51:34 -0800 Subject: [PATCH] Make KVM `ioctl(2)` seccomp filter use non-negative FD as `arg[0]` on ARM. We have a test that enforces this now, and it fails on ARM due to this. PiperOrigin-RevId: 609811953 --- pkg/sentry/platform/kvm/filters_arm64.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/sentry/platform/kvm/filters_arm64.go b/pkg/sentry/platform/kvm/filters_arm64.go index 9ceeda8a4..4d964d88b 100644 --- a/pkg/sentry/platform/kvm/filters_arm64.go +++ b/pkg/sentry/platform/kvm/filters_arm64.go @@ -28,7 +28,7 @@ import ( func (*KVM) archSyscallFilters() seccomp.SyscallRules { return seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{ unix.SYS_IOCTL: seccomp.PerArg{ - seccomp.AnyValue{}, + seccomp.NonNegativeFD{}, seccomp.EqualTo(KVM_SET_VCPU_EVENTS), }, })