From dea1155b1d8ef661149fc95aee03c93007b9ec12 Mon Sep 17 00:00:00 2001 From: Etienne Perot Date: Wed, 21 Feb 2024 16:35:06 -0800 Subject: [PATCH] Make KVM `ioctl(2)` seccomp filter use non-negative FD as `arg[0]` on ARM. We have a test that enforces this now, and it fails on ARM due to this. PiperOrigin-RevId: 609163474 --- pkg/sentry/platform/kvm/filters_arm64.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pkg/sentry/platform/kvm/filters_arm64.go b/pkg/sentry/platform/kvm/filters_arm64.go index 9ceeda8a4..4d964d88b 100644 --- a/pkg/sentry/platform/kvm/filters_arm64.go +++ b/pkg/sentry/platform/kvm/filters_arm64.go @@ -28,7 +28,7 @@ import ( func (*KVM) archSyscallFilters() seccomp.SyscallRules { return seccomp.MakeSyscallRules(map[uintptr]seccomp.SyscallRule{ unix.SYS_IOCTL: seccomp.PerArg{ - seccomp.AnyValue{}, + seccomp.NonNegativeFD{}, seccomp.EqualTo(KVM_SET_VCPU_EVENTS), }, })