diff --git a/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in b/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in index 5694fd025f..5216c0c270 100644 --- a/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in +++ b/src/runtime-rs/config/configuration-cloud-hypervisor.toml.in @@ -195,6 +195,9 @@ block_device_driver = "virtio-blk-pci" # result in memory pre allocation #enable_hugepages = true +# Disable the 'seccomp' feature from Cloud Hypervisor or firecracker, default false +# disable_seccomp = true + # This option changes the default hypervisor and kernel parameters # to enable debug output where available. # diff --git a/src/runtime-rs/config/configuration-rs-fc.toml.in b/src/runtime-rs/config/configuration-rs-fc.toml.in index 0c51259f74..13adf84998 100644 --- a/src/runtime-rs/config/configuration-rs-fc.toml.in +++ b/src/runtime-rs/config/configuration-rs-fc.toml.in @@ -145,6 +145,9 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_FC@" # result in memory pre allocation #enable_hugepages = true +# Disable the 'seccomp' feature from Cloud Hypervisor or firecracker, default false +# disable_seccomp = true + # Enable vIOMMU, default false # Enabling this will result in the VM having a vIOMMU device # This will also add the following options to the kernel's diff --git a/src/runtime-rs/crates/hypervisor/src/firecracker/inner.rs b/src/runtime-rs/crates/hypervisor/src/firecracker/inner.rs index 45859b5b10..1efb4f62fe 100644 --- a/src/runtime-rs/crates/hypervisor/src/firecracker/inner.rs +++ b/src/runtime-rs/crates/hypervisor/src/firecracker/inner.rs @@ -103,6 +103,9 @@ impl FcInner { cmd.args(["--api-sock", &self.asock_path]); } } + if self.config.security_info.disable_seccomp { + cmd.arg("--no-seccomp"); + } debug!(sl(), "Exec: {:?}", cmd); // Make sure we're in the correct Network Namespace