From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:44652)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1ZhxE7-0007Ab-F7
	for qemu-devel@nongnu.org; Fri, 02 Oct 2015 06:06:08 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1ZhxE3-0007xv-ES
	for qemu-devel@nongnu.org; Fri, 02 Oct 2015 06:06:07 -0400
Received: from mx1.redhat.com ([209.132.183.28]:52219)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <armbru@redhat.com>) id 1ZhxE3-0007xr-8o
	for qemu-devel@nongnu.org; Fri, 02 Oct 2015 06:06:03 -0400
From: Markus Armbruster <armbru@redhat.com>
References: <N1-fOl1digGhI@Safe-mail.net>
	<87r3leztbr.fsf@blackfin.pond.sub.org>
	<20151002083047.GA28469@redhat.com>
Date: Fri, 02 Oct 2015 12:05:58 +0200
In-Reply-To: <20151002083047.GA28469@redhat.com> (Daniel P. Berrange's message
	of "Fri, 2 Oct 2015 09:30:47 +0100")
Message-ID: <87twq9bn5l.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain
Subject: Re: [Qemu-devel] [PATCH] Add syscalls for -runas and -chroot to the
	seccomp sandbox
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: "Daniel P. Berrange" <berrange@redhat.com>
Cc: Namsun Ch'o <namnamc@Safe-mail.net>, qemu-devel@nongnu.org, eduardo.otubo@profitbricks.com

"Daniel P. Berrange" <berrange@redhat.com> writes:

> On Thu, Oct 01, 2015 at 02:06:32PM +0200, Markus Armbruster wrote:
>> "Namsun Ch'o" <namnamc@Safe-mail.net> writes:
>> 
>> > The seccomp sandbox doesn't whitelist setuid, setgid, or
>> > setgroups, which are
>> > needed for -runas to work. It also doesn't whitelist chroot, which is needed
>> > for the -chroot option. Unfortunately, QEMU enables seccomp before it drops
>> > privileges or chroots, so without these whitelisted, -runas and
>> > -chroot cause
>> > QEMU to be killed with -sandbox on. This patch adds those syscalls.
>> 
>> Should it enable seccomp a bit later?
>
> Yeah, I think it would be better to move the seccomp enablement later.

Let's do that then.

> Adding setuid and chroot to the allow list is pretty strongly undesirable
> from a security protection POV.

Indeed.