* [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
@ 2012-09-20 21:00 Eduardo Otubo
2012-09-21 11:21 ` Kevin Wolf
2012-09-26 15:14 ` Paul Moore
0 siblings, 2 replies; 9+ messages in thread
From: Eduardo Otubo @ 2012-09-20 21:00 UTC (permalink / raw)
To: qemu-devel; +Cc: Eduardo Otubo
Seccomp syscall whitelist updated after tests running qemu under
libvirt. Reference to the bug -
https://bugzilla.redhat.com/show_bug.cgi?id=855162
Regards,
---
qemu-seccomp.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 64329a3..4712338 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
{ SCMP_SYS(setsockopt), 245},
{ SCMP_SYS(uname), 245},
{ SCMP_SYS(semget), 245},
+ { SCMP_SYS(accept4), 241 },
#endif
{ SCMP_SYS(eventfd2), 245 },
{ SCMP_SYS(dup), 245 },
@@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
{ SCMP_SYS(getsockname), 242 },
{ SCMP_SYS(getpeername), 242 },
{ SCMP_SYS(fdatasync), 242 },
- { SCMP_SYS(close), 242 }
+ { SCMP_SYS(close), 242 },
+ { SCMP_SYS(unlink), 241 },
+ { SCMP_SYS(statfs), 241 },
+ { SCMP_SYS(getuid), 241 },
+ { SCMP_SYS(ftruncate), 241 },
+ { SCMP_SYS(getegid), 241 },
+ { SCMP_SYS(geteuid), 241 },
+ { SCMP_SYS(getgid), 241 },
+ { SCMP_SYS(getrlimit), 241 },
+ { SCMP_SYS(set_tid_address), 241 },
+ { SCMP_SYS(socketpair), 241 },
+ { SCMP_SYS(fstatfs), 241 },
+ { SCMP_SYS(epoll_create), 241 },
+ { SCMP_SYS(epoll_ctl), 241 },
+ { SCMP_SYS(epoll_wait), 241 },
+ { SCMP_SYS(pipe), 241 },
+ { SCMP_SYS(poll), 241 },
+ { SCMP_SYS(rt_sigpending), 241 },
+ { SCMP_SYS(rt_sigtimedwait), 241 },
};
int seccomp_start(void)
--
1.7.12
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-20 21:00 [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist Eduardo Otubo
@ 2012-09-21 11:21 ` Kevin Wolf
2012-09-21 12:40 ` Eduardo Otubo
2012-09-26 15:14 ` Paul Moore
1 sibling, 1 reply; 9+ messages in thread
From: Kevin Wolf @ 2012-09-21 11:21 UTC (permalink / raw)
To: Eduardo Otubo; +Cc: qemu-devel
Am 20.09.2012 23:00, schrieb Eduardo Otubo:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt. Reference to the bug -
> https://bugzilla.redhat.com/show_bug.cgi?id=855162
>
> Regards,
> ---
> qemu-seccomp.c | 21 ++++++++++++++++++++-
> 1 file changed, 20 insertions(+), 1 deletion(-)
SoB is missing.
Kevin
^ permalink raw reply [flat|nested] 9+ messages in thread
* [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-21 11:21 ` Kevin Wolf
@ 2012-09-21 12:40 ` Eduardo Otubo
2012-09-24 12:36 ` Eduardo Otubo
` (2 more replies)
0 siblings, 3 replies; 9+ messages in thread
From: Eduardo Otubo @ 2012-09-21 12:40 UTC (permalink / raw)
To: qemu-devel; +Cc: Eduardo Otubo
Seccomp syscall whitelist updated after tests running qemu under
libvirt. Reference to the bug -
https://bugzilla.redhat.com/show_bug.cgi?id=855162
Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
---
qemu-seccomp.c | 21 ++++++++++++++++++++-
1 file changed, 20 insertions(+), 1 deletion(-)
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 64329a3..4712338 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
{ SCMP_SYS(setsockopt), 245},
{ SCMP_SYS(uname), 245},
{ SCMP_SYS(semget), 245},
+ { SCMP_SYS(accept4), 241 },
#endif
{ SCMP_SYS(eventfd2), 245 },
{ SCMP_SYS(dup), 245 },
@@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
{ SCMP_SYS(getsockname), 242 },
{ SCMP_SYS(getpeername), 242 },
{ SCMP_SYS(fdatasync), 242 },
- { SCMP_SYS(close), 242 }
+ { SCMP_SYS(close), 242 },
+ { SCMP_SYS(unlink), 241 },
+ { SCMP_SYS(statfs), 241 },
+ { SCMP_SYS(getuid), 241 },
+ { SCMP_SYS(ftruncate), 241 },
+ { SCMP_SYS(getegid), 241 },
+ { SCMP_SYS(geteuid), 241 },
+ { SCMP_SYS(getgid), 241 },
+ { SCMP_SYS(getrlimit), 241 },
+ { SCMP_SYS(set_tid_address), 241 },
+ { SCMP_SYS(socketpair), 241 },
+ { SCMP_SYS(fstatfs), 241 },
+ { SCMP_SYS(epoll_create), 241 },
+ { SCMP_SYS(epoll_ctl), 241 },
+ { SCMP_SYS(epoll_wait), 241 },
+ { SCMP_SYS(pipe), 241 },
+ { SCMP_SYS(poll), 241 },
+ { SCMP_SYS(rt_sigpending), 241 },
+ { SCMP_SYS(rt_sigtimedwait), 241 },
};
int seccomp_start(void)
--
1.7.12
^ permalink raw reply related [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-21 12:40 ` Eduardo Otubo
@ 2012-09-24 12:36 ` Eduardo Otubo
2012-09-26 16:55 ` Cole Robinson
2012-09-26 20:10 ` Paul Moore
2 siblings, 0 replies; 9+ messages in thread
From: Eduardo Otubo @ 2012-09-24 12:36 UTC (permalink / raw)
To: qemu-devel
Anyone interested in taking a look at this piece of code? Thanks!
On Fri, Sep 21, 2012 at 09:40:33AM -0300, Eduardo Otubo wrote:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt. Reference to the bug -
> https://bugzilla.redhat.com/show_bug.cgi?id=855162
>
> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> ---
> qemu-seccomp.c | 21 ++++++++++++++++++++-
> 1 file changed, 20 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 64329a3..4712338 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> { SCMP_SYS(setsockopt), 245},
> { SCMP_SYS(uname), 245},
> { SCMP_SYS(semget), 245},
> + { SCMP_SYS(accept4), 241 },
> #endif
> { SCMP_SYS(eventfd2), 245 },
> { SCMP_SYS(dup), 245 },
> @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> { SCMP_SYS(getsockname), 242 },
> { SCMP_SYS(getpeername), 242 },
> { SCMP_SYS(fdatasync), 242 },
> - { SCMP_SYS(close), 242 }
> + { SCMP_SYS(close), 242 },
> + { SCMP_SYS(unlink), 241 },
> + { SCMP_SYS(statfs), 241 },
> + { SCMP_SYS(getuid), 241 },
> + { SCMP_SYS(ftruncate), 241 },
> + { SCMP_SYS(getegid), 241 },
> + { SCMP_SYS(geteuid), 241 },
> + { SCMP_SYS(getgid), 241 },
> + { SCMP_SYS(getrlimit), 241 },
> + { SCMP_SYS(set_tid_address), 241 },
> + { SCMP_SYS(socketpair), 241 },
> + { SCMP_SYS(fstatfs), 241 },
> + { SCMP_SYS(epoll_create), 241 },
> + { SCMP_SYS(epoll_ctl), 241 },
> + { SCMP_SYS(epoll_wait), 241 },
> + { SCMP_SYS(pipe), 241 },
> + { SCMP_SYS(poll), 241 },
> + { SCMP_SYS(rt_sigpending), 241 },
> + { SCMP_SYS(rt_sigtimedwait), 241 },
> };
>
> int seccomp_start(void)
> --
> 1.7.12
>
--
Eduardo Otubo
Software Engineer
Linux Technology Center
IBM Systems & Technology Group
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-20 21:00 [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist Eduardo Otubo
2012-09-21 11:21 ` Kevin Wolf
@ 2012-09-26 15:14 ` Paul Moore
2012-09-26 16:24 ` Eduardo Otubo
1 sibling, 1 reply; 9+ messages in thread
From: Paul Moore @ 2012-09-26 15:14 UTC (permalink / raw)
To: Eduardo Otubo; +Cc: qemu-devel
On Thursday, September 20, 2012 06:00:59 PM Eduardo Otubo wrote:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt ...
Hi Eduardo,
I know from our discussions offlist that you have an additional debugging
patch to help identify missing syscalls, perhaps you could also submit that
patch too? I think we would want the debugging patch #ifdef'd out in normal
use, but I think it might help the QEMU developers.
--
paul moore
security and virtualization @ redhat
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-26 15:14 ` Paul Moore
@ 2012-09-26 16:24 ` Eduardo Otubo
2012-09-26 16:42 ` Paul Moore
0 siblings, 1 reply; 9+ messages in thread
From: Eduardo Otubo @ 2012-09-26 16:24 UTC (permalink / raw)
To: Paul Moore; +Cc: qemu-devel
On Wed, Sep 26, 2012 at 11:14:29AM -0400, Paul Moore wrote:
> On Thursday, September 20, 2012 06:00:59 PM Eduardo Otubo wrote:
> > Seccomp syscall whitelist updated after tests running qemu under
> > libvirt ...
>
> Hi Eduardo,
>
> I know from our discussions offlist that you have an additional debugging
> patch to help identify missing syscalls, perhaps you could also submit that
> patch too? I think we would want the debugging patch #ifdef'd out in normal
> use, but I think it might help the QEMU developers.
That's surely a good thing Paul. I'll rebase my patches and send it
right away. Thanks!
--
Eduardo Otubo
Software Engineer
Linux Technology Center
IBM Systems & Technology Group
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-26 16:24 ` Eduardo Otubo
@ 2012-09-26 16:42 ` Paul Moore
0 siblings, 0 replies; 9+ messages in thread
From: Paul Moore @ 2012-09-26 16:42 UTC (permalink / raw)
To: Eduardo Otubo; +Cc: qemu-devel
On Wednesday, September 26, 2012 01:24:54 PM Eduardo Otubo wrote:
> On Wed, Sep 26, 2012 at 11:14:29AM -0400, Paul Moore wrote:
> > On Thursday, September 20, 2012 06:00:59 PM Eduardo Otubo wrote:
> > > Seccomp syscall whitelist updated after tests running qemu under
> > > libvirt ...
> >
> > Hi Eduardo,
> >
> > I know from our discussions offlist that you have an additional debugging
> > patch to help identify missing syscalls, perhaps you could also submit
> > that patch too? I think we would want the debugging patch #ifdef'd out in
> > normal use, but I think it might help the QEMU developers.
>
> That's surely a good thing Paul. I'll rebase my patches and send it
> right away. Thanks!
Great, I think that will be a nice addition.
Also, FWIW, I don't think you need to rebase/resubmit the patch you already
sent, just port your debugging patch to go on top.
--
paul moore
security and virtualization @ redhat
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-21 12:40 ` Eduardo Otubo
2012-09-24 12:36 ` Eduardo Otubo
@ 2012-09-26 16:55 ` Cole Robinson
2012-09-26 20:10 ` Paul Moore
2 siblings, 0 replies; 9+ messages in thread
From: Cole Robinson @ 2012-09-26 16:55 UTC (permalink / raw)
To: Eduardo Otubo; +Cc: qemu-devel, qemu-stable
On 09/21/2012 08:40 AM, Eduardo Otubo wrote:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt. Reference to the bug -
> https://bugzilla.redhat.com/show_bug.cgi?id=855162
>
> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> ---
> qemu-seccomp.c | 21 ++++++++++++++++++++-
> 1 file changed, 20 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 64329a3..4712338 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> { SCMP_SYS(setsockopt), 245},
> { SCMP_SYS(uname), 245},
> { SCMP_SYS(semget), 245},
> + { SCMP_SYS(accept4), 241 },
> #endif
> { SCMP_SYS(eventfd2), 245 },
> { SCMP_SYS(dup), 245 },
> @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> { SCMP_SYS(getsockname), 242 },
> { SCMP_SYS(getpeername), 242 },
> { SCMP_SYS(fdatasync), 242 },
> - { SCMP_SYS(close), 242 }
> + { SCMP_SYS(close), 242 },
> + { SCMP_SYS(unlink), 241 },
> + { SCMP_SYS(statfs), 241 },
> + { SCMP_SYS(getuid), 241 },
> + { SCMP_SYS(ftruncate), 241 },
> + { SCMP_SYS(getegid), 241 },
> + { SCMP_SYS(geteuid), 241 },
> + { SCMP_SYS(getgid), 241 },
> + { SCMP_SYS(getrlimit), 241 },
> + { SCMP_SYS(set_tid_address), 241 },
> + { SCMP_SYS(socketpair), 241 },
> + { SCMP_SYS(fstatfs), 241 },
> + { SCMP_SYS(epoll_create), 241 },
> + { SCMP_SYS(epoll_ctl), 241 },
> + { SCMP_SYS(epoll_wait), 241 },
> + { SCMP_SYS(pipe), 241 },
> + { SCMP_SYS(poll), 241 },
> + { SCMP_SYS(rt_sigpending), 241 },
> + { SCMP_SYS(rt_sigtimedwait), 241 },
> };
>
> int seccomp_start(void)
>
If this is required for libvirt + seccomp, might be a candidate for 1.2
stable, cc'ing. At the very least we will be carrying this in Fedora 18.
- Cole
^ permalink raw reply [flat|nested] 9+ messages in thread
* Re: [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist
2012-09-21 12:40 ` Eduardo Otubo
2012-09-24 12:36 ` Eduardo Otubo
2012-09-26 16:55 ` Cole Robinson
@ 2012-09-26 20:10 ` Paul Moore
2 siblings, 0 replies; 9+ messages in thread
From: Paul Moore @ 2012-09-26 20:10 UTC (permalink / raw)
To: Eduardo Otubo; +Cc: qemu-devel
[-- Attachment #1: Type: text/plain, Size: 2096 bytes --]
On Friday, September 21, 2012 09:40:33 AM Eduardo Otubo wrote:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt. Reference to the bug -
> https://bugzilla.redhat.com/show_bug.cgi?id=855162
Unfortunately, this patch still does not work correctly for me using
F17/libvirt and a F16 guest. The QEMU instance starts, and the guest appears
to be running, but I never see any of the BIOS POST messages on the console.
I'm attaching the guest's XML definition file if that helps.
> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> ---
> qemu-seccomp.c | 21 ++++++++++++++++++++-
> 1 file changed, 20 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 64329a3..4712338 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -70,6 +70,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[]
> = { { SCMP_SYS(setsockopt), 245},
> { SCMP_SYS(uname), 245},
> { SCMP_SYS(semget), 245},
> + { SCMP_SYS(accept4), 241 },
> #endif
> { SCMP_SYS(eventfd2), 245 },
> { SCMP_SYS(dup), 245 },
> @@ -107,7 +108,25 @@ static const struct QemuSeccompSyscall
> seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 },
> { SCMP_SYS(getpeername), 242 },
> { SCMP_SYS(fdatasync), 242 },
> - { SCMP_SYS(close), 242 }
> + { SCMP_SYS(close), 242 },
> + { SCMP_SYS(unlink), 241 },
> + { SCMP_SYS(statfs), 241 },
> + { SCMP_SYS(getuid), 241 },
> + { SCMP_SYS(ftruncate), 241 },
> + { SCMP_SYS(getegid), 241 },
> + { SCMP_SYS(geteuid), 241 },
> + { SCMP_SYS(getgid), 241 },
> + { SCMP_SYS(getrlimit), 241 },
> + { SCMP_SYS(set_tid_address), 241 },
> + { SCMP_SYS(socketpair), 241 },
> + { SCMP_SYS(fstatfs), 241 },
> + { SCMP_SYS(epoll_create), 241 },
> + { SCMP_SYS(epoll_ctl), 241 },
> + { SCMP_SYS(epoll_wait), 241 },
> + { SCMP_SYS(pipe), 241 },
> + { SCMP_SYS(poll), 241 },
> + { SCMP_SYS(rt_sigpending), 241 },
> + { SCMP_SYS(rt_sigtimedwait), 241 },
> };
>
> int seccomp_start(void)
--
paul moore
security and virtualization @ redhat
[-- Attachment #2: f16-test-1.xml --]
[-- Type: application/xml, Size: 2353 bytes --]
^ permalink raw reply [flat|nested] 9+ messages in thread
end of thread, other threads:[~2012-09-26 20:10 UTC | newest]
Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2012-09-20 21:00 [Qemu-devel] [PATCH] New syscalls to the seccomp whitelist Eduardo Otubo
2012-09-21 11:21 ` Kevin Wolf
2012-09-21 12:40 ` Eduardo Otubo
2012-09-24 12:36 ` Eduardo Otubo
2012-09-26 16:55 ` Cole Robinson
2012-09-26 20:10 ` Paul Moore
2012-09-26 15:14 ` Paul Moore
2012-09-26 16:24 ` Eduardo Otubo
2012-09-26 16:42 ` Paul Moore
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).