<html> <head> <base href="https://bugs.freedesktop.org/"> </head> <body> <div> <a class="bz_bug_link bz_status_NEW " title="NEW - qemu using spice gl and sandbox resourcecontrol=deny crashes with SIGSYS on radeonsi" href="https://bugs.freedesktop.org/show_bug.cgi?id=109695#c9">Comment # 9</a> on <a class="bz_bug_link bz_status_NEW " title="NEW - qemu using spice gl and sandbox resourcecontrol=deny crashes with SIGSYS on radeonsi" href="https://bugs.freedesktop.org/show_bug.cgi?id=109695">bug 109695</a> from <a class="email" href="mailto:Ahzo@tutanota.com" title="Ahzo@tutanota.com">Ahzo@tutanota.com</a> <pre>(In reply to Daniel P. Berrange from <a href="show_bug.cgi?id=109695#c3">comment #3</a>) > (In reply to Ahzo from <a href="show_bug.cgi?id=109695#c2">comment #2</a>) > > To check for the availability of the syscall, one can try it in a child > > process and see if the child is terminated by a signal, e.g. like this: > > Afraid not, QEMU's seccomp filter blocks use of fork() too :-) Maybe it should, at least when using the spawn=deny option, but currently it doesn't. That option only blocks the fork, vfork and execve syscalls, but glibc's fork() function uses the clone syscall, and thus continues to work. However, that behavior might be different when using other C library implementations, so it wouldn't be correct to rely on this. One could use clone() instead of fork(), but future versions of qemu might block the clone syscall, as well. Unfortunately, I'm not aware of a proper solution for this bug short of adding a new API to the kernel.</pre> </div> <hr> You are receiving this mail because: <ul> <li>You are the assignee for the bug.</li> </ul> </body> </html>