Description of problem:
qemu-kvm hang when enabled both sandbox and mlock
Version-Release number of selected component (if applicable):
Steps to Reproduce:
1.Start qemu-kvm with enable sandbox and mlock
/usr/libexec/qemu-kvm -M pc -monitor stdio -vnc :0 -realtime mlock=on -sandbox on
5600 pts/0 S+ 0:00 strace /usr/libexec/qemu-kvm -M pc -monitor stdio -vnc :0 -realtime mlock=on -sandbox on
5603 pts/0 Zl+ 0:00 [qemu-kvm] <defunct>
qemu-kvm work well.
Created attachment 980391 [details]
qemu-kvm-1.5.3-60.el7 can't hit this problem.
qemu-kvm-1.5.3-85.el7.x86_64 works well.
I can reproduce it, it looks like mlockall() is missing from the syscall whitelist.
Start qemu-kvm by libvirt also hit this problem.
# Use seccomp syscall whitelisting in QEMU.
# 1 = on, 0 = off, -1 = use QEMU default
# Defaults to -1.
seccomp_sandbox = 1
Libvirt xml file.
Fix included in qemu-kvm-rhev-2.1.2-21.el7
Reproduced with qemu-kvm-rhev-2.1.2-20.el7.x86_64.
1. start a guest with both -sandbox on -realtime mlock=on
No response from HMP. qemu-kvm died. ps shows:
Verified pass with qemu-kvm-rhev-2.1.2-21.el7.x86_64. Guest can boot up correctly. So this bug got fixed.
Since the problem described in this bug report should be
resolved in a recent advisory, it has been closed with a
resolution of ERRATA.
For information on the advisory, and where to find the updated
files, follow the link below.
If the solution does not work for you, open a new bug report.