Skip to content

[blk-threaded - 3/5] seccomp: add block worker thread filter #6131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PierreBertholom wants to merge 4 commits into from
Open

[blk-threaded - 3/5] seccomp: add block worker thread filter #6131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
6064538
seccompiler: truncate memfd before each BPF export
PierreBertholom Aug 13, 2026
a8d0348
test: fix x86 regs for seccomp static analysis
PierreBertholom Jul 29, 2026
2d5cc71
seccomp: add block worker thread filter
PierreBertholom Aug 13, 2026
b8eee34
docs: document seccomp thread categories
PierreBertholom Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions docs/seccompiler.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,8 +77,11 @@ This means that Firecracker has a JSON file for each supported target (currently
determined by the arch-libc combinations). You can view them in
`resources/seccomp`.

At the top level, the file requires an object that maps thread categories (vmm,
api and vcpu) to seccomp filters:
At the top level, the file contains an object that maps thread categories to
seccomp filters. Firecracker allows the `vmm`, `api`, `vcpu`, and `blk_worker`
categories. The `vmm`, `api`, and `vcpu` categories are mandatory. The
`blk_worker` category is optional and is needed only when a block device uses a
dedicated worker thread.

```
{
Expand All @@ -91,6 +94,7 @@ api and vcpu) to seccomp filters:
},
"api": {...},
"vcpu": {...},
"blk_worker": {...}
}
```

Expand Down
Loading
Loading