Re: [Qemu-devel] [PATCH] Add a few argument filters to the seccomp sandbox

[Paul Moore <pmoore@redhat.com>]

On Thursday, September 10, 2015 03:48:52 PM Daniel P. Berrange wrote:
> On Wed, Sep 09, 2015 at 09:55:33PM -0400, namnamc@Safe-mail.net wrote:
> > +
> > +    /* shmget */
> > +    rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2,
> > +        SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE),
> > +        SCMP_A2(SCMP_CMP_EQ, IP_CREAT|0777));
> 
> I'm not familiar with semantics of these seccomp rules, but is this
> saying that the second arg must be exactly equal to IP_CREAT|0777 ?

Yes.

> If the app passes IP_CREAT|0600, would that be permitted instead ?
> The latter is what I see gtk2 source code passing for mode.

It wouldn't match the rule as written above, if it doesn't match any other 
configured rules it would hit the default filter action.

-- 
paul moore
security @ redhat