From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: Received: from gate001.proxmox.com (gate001.proxmox.com [45.144.208.40]) by lore.proxmox.com (Postfix) with ESMTPS id 720F91FF0AD for ; Sat, 22 Aug 2026 16:44:51 +0200 (CEST) Received: from gate001.proxmox.com (localhost.localdomain [127.0.0.1]) by gate001.proxmox.com (Proxmox) with ESMTP id 8F1D921591; Sat, 22 Aug 2026 16:44:50 +0200 (CEST) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=ionescu.at; s=protonmail2; t=1787409041; x=1787668241; bh=tqmuqnnJI1GZdJJyQyD9cvZMLvWPcqupq9eAkpBOSdk=; h=Date:To:From:Subject:Message-ID:Feedback-ID:From:To:Cc:Date: Subject:Reply-To:Feedback-ID:Message-ID:BIMI-Selector; b=PiFbvofh8UF2V0Mz+qXovc5lhK2qiyg7KEOzCyfaEAI90VZ6tYriwRicvquvAHr8X +GSQiw0725zlpyVOILe0wiRGjzjWFRexbVHfr3ocJbXylElYkYFeIw7JCCsheAa2Si 1QWvrzM4tbR6KRz8ircWb+Vz0rxnGyDCeO4MYK2rkeTBbQZ3QRpnY8Jfml+NKwmm6A 1GMJ0KqwjrmCj3Ckn5hRxnwjDiNlEXgAqCiJvUhpvHkcUFilCZbHp/KXTyWEEVfdmU Qt18ebkCyEq3lZq9yIcp/2VvtGRP1tUIkBYo413DRo0P8iLCqNBnj488gF14umPjlr KdM5TER8DgmNg== Date: Sat, 22 Aug 2026 14:30:38 +0000 To: "pve-devel@lists.proxmox.com" From: Bogdan Ionescu Subject: [RFC] qemu-server: add opt-in support for QEMU seccomp sandbox Message-ID: Feedback-ID: 36014335:user:proton X-Pm-Message-ID: 706bb5fd242fedeed46e0901f30fcc0eac51c9bf MIME-Version: 1.0 X-SPAM-LEVEL: Spam detection results: 0 DKIM_SIGNED 0.1 Message has a DKIM or DK signature, not necessarily valid DKIM_VALID -0.1 Message has at least one valid DKIM or DK signature DKIM_VALID_AU -0.1 Message has a valid DKIM or DK signature from author's domain DKIM_VALID_EF -0.1 Message has a valid DKIM or DK signature from envelope-from domain DMARC_PASS -0.1 DMARC pass policy HTML_MESSAGE 0.001 HTML included in message RCVD_IN_DNSWL_LOW -0.7 Sender listed at https://www.dnswl.org/, low trust SPF_HELO_PASS -0.001 SPF: HELO matches SPF record SPF_PASS -0.001 SPF: sender matches SPF record Message-ID-Hash: BP3FDWFVTN4IY2VBR36SDIIVNM4VEWTN X-Message-ID-Hash: BP3FDWFVTN4IY2VBR36SDIIVNM4VEWTN X-MailFrom: bogdan@ionescu.at X-Mailman-Rule-Misses: dmarc-mitigation; no-senders; approved; loop; banned-address; emergency; member-moderation; nonmember-moderation; administrivia; implicit-dest; max-recipients; max-size; news-moderation; no-subject; digests; suspicious-header Content-Transfer-Encoding: base64 Content-Type: text/plain; charset=utf-8 X-Content-Filtered-By: Mailman/MimeDel 3.3.10 X-Mailman-Version: 3.3.10 Precedence: list List-Id: Proxmox VE development discussion List-Help: List-Owner: List-Post: List-Subscribe: List-Unsubscribe: SGkgYWxsLAoKSSdkIGxpa2UgdG8gZ2F1Z2UgaW50ZXJlc3QgaW4gZXhwb3NpbmcgUUVNVSdzIGJ1 aWx0LWluIHNlY2NvbXAgc2FuZGJveCBhcyBhIGZpcnN0LWNsYXNzIHFlbXUtc2VydmVyIG9wdGlv biwgYmVmb3JlIHByZXBhcmluZyBhIHBhdGNoLgoKPT0gTW90aXZhdGlvbiA9PQoKUUVNVSBwcm92 aWRlcyB0aGUgLXNhbmRib3ggb24gb3B0aW9uLCB3aGljaCBpbnN0YWxscyBhIHNlY2NvbXAgbW9k ZSAyIHN5c2NhbGwgZmlsdGVyIGZvciB0aGUgUUVNVSBwcm9jZXNzLgoKVGhlIFBWRSBRRU1VIHBh Y2thZ2UgaXMgYWxyZWFkeSBidWlsdCB3aXRoIHNlY2NvbXAgc3VwcG9ydCAoLS1lbmFibGUtc2Vj Y29tcCksIHNvIHRoaXMgY3VycmVudGx5IHdvcmtzIHdoZW4gYWRkZWQgbWFudWFsbHkgdG8gYSBW TSBjb25maWd1cmF0aW9uOgoKYXJnczogLXNhbmRib3ggb24KClRoZXJlIGlzLCBob3dldmVyLCBu byBmaXJzdC1jbGFzcyBxZW11LXNlcnZlciBvcHRpb24gZm9yIGVuYWJsaW5nIGl0LgoKU2luY2Ug dGhlIFFFTVUgcHJvY2VzcyByZXByZXNlbnRzIGEgc2lnbmlmaWNhbnQgcGFydCBvZiB0aGUgYXR0 YWNrIHN1cmZhY2UgYmV0d2VlbiBhbiB1bnRydXN0ZWQgZ3Vlc3QgYW5kIHRoZSBob3N0LCBlbmFi bGluZyBRRU1VJ3Mgb3duIHN5c2NhbGwgZmlsdGVyaW5nIHNlZW1zIGxpa2UgYSByZWxhdGl2ZWx5 IHNtYWxsIGFkZGl0aW9uYWwgZGVmZW5zZS1pbi1kZXB0aCBtZWFzdXJlLgoKVGhpcyBpcyBjb21w bGVtZW50YXJ5IHRvIHRoZSBBcHBBcm1vci1mb3ItS1ZNIGRpc2N1c3Npb24gZnJvbSBsYXN0IHll YXIsIGJ1dCBjb25zaWRlcmFibHkgc21hbGxlciBpbiBzY29wZSBzaW5jZSB0aGUgZmlsdGVyaW5n IGFuZCBwb2xpY3kgYXJlIG1haW50YWluZWQgdXBzdHJlYW0gYnkgUUVNVSBhbmQgZG9uJ3QgcmVx dWlyZSBnZW5lcmF0aW5nIHBlci1WTSBmaWxlc3lzdGVtIHByb2ZpbGVzLgoKVGhlcmUgaXMgYWxz byBhbiBleGlzdGluZyBmZWF0dXJlIHJlcXVlc3QgZm9yIHRoaXMsICM2NDEzLgoKPT0gUHJvcG9z YWwgPT0KCkluaXRpYWxseSBleHBvc2UgdGhlIGJhc2ljIFFFTVUgc2FuZGJveCBhcyBhbiBvcHQt aW4gcGVyLVZNIHNldHRpbmcsIGUuZy46CgpzYW5kYm94OiAxCgpvcjoKCnFtIHNldCA8dm1pZD4g LS1zYW5kYm94IDEKCndoaWNoIHdvdWxkIGNhdXNlIHFlbXUtc2VydmVyIHRvIGFkZDoKCi1zYW5k Ym94IG9uCgp0byB0aGUgUUVNVSBjb21tYW5kIGxpbmUuCgpJIHdvdWxkIGludGVudGlvbmFsbHkg a2VlcCB0aGUgZmlyc3QgaW1wbGVtZW50YXRpb24gbGltaXRlZCB0byBwbGFpbgotc2FuZGJveCBv bi4KCkluIHBhcnRpY3VsYXIsIEkgd291bGQgbm90IGluaXRpYWxseSBlbmFibGUgdGhlIGFkZGl0 aW9uYWwgUUVNVSBzYW5kYm94CnJlc3RyaWN0aW9uczoKCmVsZXZhdGVwcml2aWxlZ2VzPWRlbnkK c3Bhd249ZGVueQpyZXNvdXJjZWNvbnRyb2w9ZGVueQoKVGhvc2UgY291bGQgcG90ZW50aWFsbHkg aW50ZXJmZXJlIHdpdGggbGVzcyBjb21tb24gUUVNVSBjb25maWd1cmF0aW9ucyBvcgpmZWF0dXJl cyBhbmQgY291bGQgYmUgZXZhbHVhdGVkIHNlcGFyYXRlbHkgb25jZSB0aGUgYmFzaWMgc2FuZGJv eCBoYXMgaGFkCndpZGVyIHRlc3RpbmcuCgpUaGUgaW5pdGlhbCBzZW1hbnRpY3Mgd291bGQgdGhl cmVmb3JlIGJlOgoKLSBkaXNhYmxlZCBieSBkZWZhdWx0LCBzbyBleGlzdGluZyBWTXMgYXJlIHVu Y2hhbmdlZAotIHBlci1WTSBvcHQtaW4KLSBBUEkvQ0xJL2NvbmZpZyBzdXBwb3J0IGluIHFlbXUt c2VydmVyCi0gLXNhbmRib3ggb24gYWRkZWQgb25seSB3aGVuIGVuYWJsZWQKLSBubyBwdmUtcWVt dSBjaGFuZ2VzIHJlcXVpcmVkCi0gY2ZnMmNtZCB0ZXN0cyBmb3IgYm90aCBlbmFibGVkIGFuZCBk aXNhYmxlZCBjYXNlcwotIGRvY3VtZW50YXRpb24gZGVzY3JpYmluZyBpdCBhcyBhbiBhZGRpdGlv bmFsIGRlZmVuc2UtaW4tZGVwdGggbWVhc3VyZQoKSSd2ZSBhbHNvIHRlc3RlZCB0aGUgZXF1aXZh bGVudCBhcmdzOiAtc2FuZGJveCBvbiBjb25maWd1cmF0aW9uIHdpdGhvdXQKCm9ic2VydmluZyBp c3N1ZXMgc28gZmFyLCBmb3IgdGhlIHBhc3QgeWVhciwgb24gaHVuZHJlZHMgb2YgVk1zLgoKPT0g UG9zc2libGUgZnV0dXJlIGRpcmVjdGlvbiA9PQoKSWYgaXQgcHJvdmVzIHN1ZmZpY2llbnRseSBj b21wYXRpYmxlLCB3ZSBjb3VsZCBsYXRlciBjb25zaWRlcjoKCi0gZW5hYmxpbmcgdGhlIHNhbmRi b3ggYnkgZGVmYXVsdCBmb3IgbmV3bHkgY3JlYXRlZCBWTXMKLSBleHBvc2luZyBzb21lIG9yIGFs bCBvZiB0aGUgYWRkaXRpb25hbCBRRU1VIHNhbmRib3ggcmVzdHJpY3Rpb25zCi0gZW5hYmxpbmcg c3Ryb25nZXIgZGVmYXVsdHMgd2hlcmUgcWVtdS1zZXJ2ZXIga25vd3MgdGhleSBhcmUgc2FmZQoK SSB0aGluayBrZWVwaW5nIHRob3NlIHNlcGFyYXRlIGZyb20gdGhlIGluaXRpYWwgaW1wbGVtZW50 YXRpb24gd291bGQgbWFrZQppdCBtdWNoIGVhc2llciB0byBldmFsdWF0ZSBjb21wYXRpYmlsaXR5 LgoKPT0gT3BlbiBxdWVzdGlvbnMgPT0KCi0gV291bGQgYSBmaXJzdC1jbGFzcyBvcHQtaW4gUUVN VSBzZWNjb21wIHNhbmRib3ggb3B0aW9uIGJlIGFjY2VwdGFibGUgaW4KcHJpbmNpcGxlPwotIFdv dWxkIHlvdSBwcmVmZXIgYSBzaW1wbGUgYm9vbGVhbiBzYW5kYm94IG9wdGlvbiBpbml0aWFsbHks IG9yIGEKcHJvcGVydHkgc3RyaW5nIHNvIHRoYXQgdGhlIGFkZGl0aW9uYWwgUUVNVSBzYW5kYm94 IG9wdGlvbnMgY2FuIGJlCmV4cG9zZWQgbGF0ZXIgd2l0aG91dCBjaGFuZ2luZyB0aGUgY29uZmln dXJhdGlvbiBmb3JtYXQ/Ci0gSXMgcGxhaW4gLXNhbmRib3ggb24gY29uc2VydmF0aXZlIGVub3Vn aCBmb3IgYW4gaW5pdGlhbCBpbXBsZW1lbnRhdGlvbiwKb3Igd291bGQgeW91IHByZWZlciBzb21l IG9mIHRoZSBhZGRpdGlvbmFsIHJlc3RyaWN0aW9ucyB0byBiZSBlbmFibGVkCmZyb20gdGhlIGJl Z2lubmluZz8KLSBJZiBjb21wYXRpYmlsaXR5IHRlc3RpbmcgbG9va3MgZ29vZCwgd291bGQgbWFr aW5nIHRoaXMgdGhlIGRlZmF1bHQgZm9yCm5ldyBWTXMgZXZlbnR1YWxseSBiZSBkZXNpcmFibGU/ CgpJZiB0aGUgZGlyZWN0aW9uIHNvdW5kcyByZWFzb25hYmxlLCBJIGNhbiBwcmVwYXJlIHRoZSBx ZW11LXNlcnZlciBwYXRjaAphbmQgdGVzdHMuCgpUaGFua3MsCkJvZ2Rhbg==