From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:34869) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VqT1z-0005UR-B0 for qemu-devel@nongnu.org; Tue, 10 Dec 2013 14:31:49 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VqT1t-0004FI-C0 for qemu-devel@nongnu.org; Tue, 10 Dec 2013 14:31:43 -0500 Received: from mx1.redhat.com ([209.132.183.28]:11800) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VqT1t-0004F4-39 for qemu-devel@nongnu.org; Tue, 10 Dec 2013 14:31:37 -0500 From: Paul Moore Date: Tue, 10 Dec 2013 14:31:28 -0500 Message-ID: <2378748.BRySzGFBvl@sifl> In-Reply-To: <52A76216.7090303@redhat.com> References: <1386609652-7876-1-git-send-email-otubo@linux.vnet.ibm.com> <52A68867.4080309@linux.vnet.ibm.com> <52A76216.7090303@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Subject: Re: [Qemu-devel] [PATCH] seccomp: "-sandbox on" won't kill Qemu when option not built in List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Lucas Meneghel Rodrigues Cc: Corey Bryant , qemu-devel@nongnu.org, anthony@codemonkey.ws, Eduardo Otubo On Tuesday, December 10, 2013 04:48:54 PM Lucas Meneghel Rodrigues wrote: > On 12/10/2013 01:20 AM, Corey Bryant wrote: > >>> IMHO the test suite should probe to see if sandbox is working or not, > >>> and > >>> just not use the "-sandbox on" arg if the host doesn't support it. > >> > >> But I think this could be done on virt-test as well :) > > > > This would make sense. > > > > Although it sounds like Lucas was looking for an error message when > > seccomp kills qemu. Maybe virt-test could grep the audit log for the > > existence of a "type=SECCOMP" record within the test's time of > > execution, and issue a message based on that. > > It's a valid idea. The problem I see with it is that not every distro > out there uses SELinux. Not getting into the merits of whether they > should, ideally it'd be nice to have this working on distros that won't > use SELinux. Minor point of clarification, but audit and SELinux and independent subsystems in the kernel. Also, and I don't have a non-audit kernel built at the moment to verify this, but on non-audit kernels the audit messages should be sent to syslog so you *should* still be able to search for SECCOMP records regardless. -- paul moore security and virtualization @ redhat