Re: [Qemu-devel] [PATCHv3 2/3] seccomp: adding command line support for blacklist

[Eduardo Otubo <otubo@linux.vnet.ibm.com>]

On 10/08/2013 09:42 PM, Eduardo Otubo wrote:
> v3: The options for blacklist in the command line also checkes the
> existence of "-netdev tap", leaving a warning message in a positive
> case.
>
> New command line options for the seccomp blacklist feature:
>
>   $ qemu -sandbox on[,strict=<on|off>]
>
> The strict parameter will turn on or off the new system call blacklist
>
> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> ---
>   qemu-options.hx |  8 +++++---
>   vl.c            | 17 ++++++++++++++++-
>   2 files changed, 21 insertions(+), 4 deletions(-)
>
> diff --git a/qemu-options.hx b/qemu-options.hx
> index d15338e..05485e1 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -2978,13 +2978,15 @@ Old param mode (ARM only).
>   ETEXI
>
>   DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
> -    "-sandbox <arg>  Enable seccomp mode 2 system call filter (default 'off').\n",
> +    "-sandbox <arg>  Enable seccomp mode 2 system call filter (default 'off').\n"
> +    "-sandbox on[,strict=<arg>]\n"
> +    "                Enable seccomp mode 2 system call second level filter (default 'off').\n",
>       QEMU_ARCH_ALL)
>   STEXI
> -@item -sandbox @var{arg}
> +@item -sandbox @var{arg}[,strict=@var{value}]
>   @findex -sandbox
>   Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will
> -disable it.  The default is 'off'.
> +disable it.  The default is 'off'. 'strict=on' will enable second level filter (default is 'off').
>   ETEXI
>
>   DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig,
> diff --git a/vl.c b/vl.c
> index ee95674..ffdf460 100644
> --- a/vl.c
> +++ b/vl.c
> @@ -330,6 +330,9 @@ static QemuOptsList qemu_sandbox_opts = {
>           {
>               .name = "enable",
>               .type = QEMU_OPT_BOOL,
> +        },{
> +            .name = "strict",
> +            .type = QEMU_OPT_STRING,
>           },
>           { /* end of list */ }
>       },
> @@ -1032,6 +1035,7 @@ static int bt_parse(const char *opt)
>
>   static int parse_sandbox(QemuOpts *opts, void *opaque)
>   {
> +    const char *strict_value = NULL;
>       /* FIXME: change this to true for 1.3 */
>       if (qemu_opt_get_bool(opts, "enable", false)) {
>   #ifdef CONFIG_SECCOMP
> @@ -1040,6 +1044,17 @@ static int parse_sandbox(QemuOpts *opts, void *opaque)
>                             "failed to install seccomp syscall filter in the kernel");
>               return -1;
>           }
> +
> +        strict_value = qemu_opt_get(opts, "strict");
> +
> +        if (!tap_enabled)
                       .------^
Just spotted tha I erased this open brace in one of my rebases.

> +           if (strict_value && !strcmp(strict_value, "on")) {
> +               enable_blacklist = true;
> +           }
> +        } else {
> +            fprintf(stderr, "Warning: seccomp syscall second level filter \"-sandbox on,strict=on\" "
> +                    "cannot work together with \"-netdev tap\". Disabling it.\n");
> +        }
>   #else
>           qerror_report(ERROR_CLASS_GENERIC_ERROR,
>                         "sandboxing request but seccomp is not compiled into this build");
> @@ -1769,7 +1784,7 @@ void vm_state_notify(int running, RunState state)
>
>   static void install_seccomp_blacklist(void)
>   {
> -    if (enable_blacklist && !tap_enabled) {
> +    if (enable_blacklist) {
>           if (seccomp_start(BLACKLIST) < 0) {
>               qerror_report(ERROR_CLASS_GENERIC_ERROR,
>                             "failed to install seccomp syscall second level filter in the kernel");
>

-- 
Eduardo Otubo
IBM Linux Technology Center