github/kata-containers
1
0
Fork 1
mirror of https://github.com/kata-containers/kata-containers.git synced 2025-08-13 21:56:32 +00:00
Code Issues Projects Releases Wiki Activity

runtime-rs: add seccomp support for cloud hypervisor and firecracker

Browse Source 
The seccomp feature for Cloud Hypervisor and Firecracker is enabled by default.
This commit introduces an option to disable seccomp for both and updates the built-in configuration.toml file accordingly.

Fixes: #11535

Signed-off-by: wangxinge <wangxinge@bupt.edu.cn>
This commit is contained in:
wangxinge 2025-07-08 15:50:26 +08:00 committed by Fupan Li
parent 407252a863
commit f3a669ee2d
3 changed files with 9 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
src/runtime-rs/config/configuration-cloud-hypervisor.toml.in
View File

@ -195,6 +195,9 @@ block_device_driver = "virtio-blk-pci"
# result in memory pre allocation
#enable_hugepages = true
# Disable the 'seccomp' feature from Cloud Hypervisor or firecracker, default false
# disable_seccomp = true
# This option changes the default hypervisor and kernel parameters
# to enable debug output where available.
#

3
src/runtime-rs/config/configuration-rs-fc.toml.in
View File

@ -145,6 +145,9 @@ block_device_driver = "@DEFBLOCKSTORAGEDRIVER_FC@"
# result in memory pre allocation
#enable_hugepages = true
# Disable the 'seccomp' feature from Cloud Hypervisor or firecracker, default false
# disable_seccomp = true
# Enable vIOMMU, default false
# Enabling this will result in the VM having a vIOMMU device
# This will also add the following options to the kernel's

3
src/runtime-rs/crates/hypervisor/src/firecracker/inner.rs
View File

@ -103,6 +103,9 @@ impl FcInner {
cmd.args(["--api-sock", &self.asock_path]);
}
}
if self.config.security_info.disable_seccomp {
cmd.arg("--no-seccomp");
}
debug!(sl(), "Exec: {:?}", cmd);
// Make sure we're in the correct Network Namespace