Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

[Eduardo Otubo <otubo@linux.vnet.ibm.com>]

On 08/29/2013 09:56 AM, Paul Moore wrote:
> On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote:
>> Now there's a second whitelist, right before the vcpu starts. The second
>> whitelist is the same as the first one, except for exec() and select().
>>
>> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
>
> We talked about this in a previous thread, but as a reminder, the kernel's
> seccomp BPF filter works by executing all of the loaded filters for each
> syscall and taking the least permissive action for all of the results.  In
> other words, if one filter returns ALLOW for a given syscall and another
> filter returns KILL, the kernel will select the KILL action for the syscall.
>
> With that in mind, I think the best option is to keep the existing whitelist
> and instead of creating a second whitelist, create a second *blacklist* that
> removes the syscalls you don't want to allow anymore, e.g. exec() and
> select().  This approach should be easier to maintain and would result in less
> overhead in the kernel's seccomp evaluator (the blacklist filter would be much
> smaller than a second whitelist filter).

You're correct. I was thinking in a whole other approach, but your point 
makes a lot more sense. As I mentioned on the IRC, I should call 
seccomp_init(SCMP_ACT_ALLOW) and seccomp_rule_add(ctx, SCMP_ACT_KILL, 
list[i].num, 0); is that correct?

Thanks,

-- 
Eduardo Otubo
IBM Linux Technology Center