From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:58950) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TQXT0-0005oG-HN for qemu-devel@nongnu.org; Tue, 23 Oct 2012 01:55:55 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TQXSz-0002fi-0A for qemu-devel@nongnu.org; Tue, 23 Oct 2012 01:55:54 -0400 Received: from e24smtp02.br.ibm.com ([32.104.18.86]:58502) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TQXSy-0002fX-G9 for qemu-devel@nongnu.org; Tue, 23 Oct 2012 01:55:52 -0400 Received: from /spool/local by e24smtp02.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 23 Oct 2012 03:55:50 -0200 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id BB4E93520050 for ; Tue, 23 Oct 2012 01:55:46 -0400 (EDT) Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q9N5tiYG2240606 for ; Tue, 23 Oct 2012 03:55:44 -0200 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q9N5tkeX028141 for ; Tue, 23 Oct 2012 03:55:46 -0200 From: Eduardo Otubo Date: Tue, 23 Oct 2012 03:55:31 -0200 Message-Id: <1350971732-16621-3-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: <1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com> References: <1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCHv2 3/4] Support for "double whitelist" filters List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, aliguori@us.ibm.com, coreyb@linux.vnet.ibm.com, Eduardo Otubo This patch includes a second whitelist right before the main loop. It's a smaller and more restricted whitelist, excluding execve() among many others. v2: * ctx changed to main_loop_ctx * seccomp_on now inside ifdef * open syscall added to the main_loop whitelist Signed-off-by: Eduardo Otubo --- qemu-seccomp.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++++++------ qemu-seccomp.h | 7 ++++- vl.c | 21 +++++++++++-- 3 files changed, 114 insertions(+), 13 deletions(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index a7b33e2..033cfad 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -13,6 +13,7 @@ * GNU GPL, version 2 or (at your option) any later version. */ #include +#include #include #include "qemu-seccomp.h" @@ -21,7 +22,7 @@ struct QemuSeccompSyscall { uint8_t priority; }; -static const struct QemuSeccompSyscall seccomp_whitelist[] = { +static const struct QemuSeccompSyscall seccomp_whitelist_init[] = { { SCMP_SYS(timer_settime), 255 }, { SCMP_SYS(timer_gettime), 254 }, { SCMP_SYS(futex), 253 }, @@ -121,27 +122,107 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(rt_sigtimedwait), 242 } }; -int seccomp_start(void) +static const struct QemuSeccompSyscall seccomp_whitelist_main_loop[] = { + { SCMP_SYS(timer_settime), 255 }, + { SCMP_SYS(timer_gettime), 254 }, + { SCMP_SYS(futex), 253 }, + { SCMP_SYS(select), 252 }, + { SCMP_SYS(recvfrom), 251 }, + { SCMP_SYS(sendto), 250 }, + { SCMP_SYS(read), 249 }, + { SCMP_SYS(brk), 248 }, + { SCMP_SYS(mmap), 247 }, + { SCMP_SYS(open), 247 }, +#if defined(__i386__) + { SCMP_SYS(fcntl64), 245 }, + { SCMP_SYS(fstat64), 245 }, + { SCMP_SYS(stat64), 245 }, + { SCMP_SYS(getgid32), 245 }, + { SCMP_SYS(getegid32), 245 }, + { SCMP_SYS(getuid32), 245 }, + { SCMP_SYS(geteuid32), 245 }, + { SCMP_SYS(sigreturn), 245 }, + { SCMP_SYS(_newselect), 245 }, + { SCMP_SYS(_llseek), 245 }, + { SCMP_SYS(mmap2), 245}, + { SCMP_SYS(sigprocmask), 245 }, +#endif + { SCMP_SYS(exit), 245 }, + { SCMP_SYS(timer_delete), 245 }, + { SCMP_SYS(exit_group), 245 }, + { SCMP_SYS(rt_sigreturn), 245 }, + { SCMP_SYS(madvise), 245 }, + { SCMP_SYS(write), 244 }, + { SCMP_SYS(fcntl), 243 }, + { SCMP_SYS(tgkill), 242 }, + { SCMP_SYS(rt_sigaction), 242 }, + { SCMP_SYS(pipe2), 242 }, + { SCMP_SYS(munmap), 242 }, + { SCMP_SYS(mremap), 242 }, + { SCMP_SYS(getsockname), 242 }, + { SCMP_SYS(getpeername), 242 }, + { SCMP_SYS(close), 242 }, + { SCMP_SYS(accept4), 242 }, + { SCMP_SYS(eventfd2), 242 }, + { SCMP_SYS(recvmsg), 242 }, + { SCMP_SYS(ioctl), 242 }, + { SCMP_SYS(rt_sigprocmask), 242 } +}; + +static int +process_whitelist(const struct QemuSeccompSyscall *whitelist, + unsigned int size, scmp_filter_ctx *ctx) { int rc = 0; + unsigned int i = 0; - scmp_filter_ctx ctx; + + for (i = 0; i < size; i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, whitelist[i].num, 0); + if (rc < 0) { + return -1; + } + + rc = seccomp_syscall_priority(ctx, whitelist[i].num, + whitelist[i].priority); + if (rc < 0) { + return -1; + } + } + return 0; +} + +int +seccomp_start(enum whitelist_mode mode, scmp_filter_ctx *ctx) +{ + int rc = 0; ctx = seccomp_init(SCMP_ACT_KILL); if (ctx == NULL) { + rc = -1; goto seccomp_return; } - for (i = 0; i < ARRAY_SIZE(seccomp_whitelist); i++) { - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, seccomp_whitelist[i].num, 0); - if (rc < 0) { + switch (mode) { + case INIT: + if (process_whitelist + (seccomp_whitelist_init, + ARRAY_SIZE(seccomp_whitelist_init), ctx) < 0) { + rc = -1; goto seccomp_return; } - rc = seccomp_syscall_priority(ctx, seccomp_whitelist[i].num, - seccomp_whitelist[i].priority); - if (rc < 0) { + break; + case MAIN_LOOP: + if (process_whitelist + (seccomp_whitelist_main_loop, + ARRAY_SIZE(seccomp_whitelist_main_loop), ctx) < 0) { + rc = -1; goto seccomp_return; } + break; + default: + rc = -1; + goto seccomp_return; } rc = seccomp_load(ctx); diff --git a/qemu-seccomp.h b/qemu-seccomp.h index b2fc3f8..1c97978 100644 --- a/qemu-seccomp.h +++ b/qemu-seccomp.h @@ -18,5 +18,10 @@ #include #include "osdep.h" -int seccomp_start(void); +enum whitelist_mode { + INIT = 0, + MAIN_LOOP = 1, +}; + +int seccomp_start(enum whitelist_mode mode, scmp_filter_ctx *ctx); #endif diff --git a/vl.c b/vl.c index bec68cd..d50018f 100644 --- a/vl.c +++ b/vl.c @@ -774,10 +774,11 @@ static int bt_parse(const char *opt) return 1; } -static int install_seccomp_filters(void) +static int +install_seccomp_filters(enum whitelist_mode mode, scmp_filter_ctx *ctx) { #ifdef CONFIG_SECCOMP - if (seccomp_start() < 0) { + if (seccomp_start(mode, ctx) < 0) { qerror_report(ERROR_CLASS_GENERIC_ERROR, "failed to install seccomp syscall filter in the kernel"); return -1; @@ -2407,6 +2408,10 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; +#ifdef CONFIG_SECCOMP + scmp_filter_ctx main_loop_ctx; +#endif + atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]); @@ -3330,11 +3335,13 @@ int main(int argc, char **argv, char **envp) } /* We should install seccomp filters even if -sandbox on is not used. */ +#ifdef CONFIG_SECCOMP if (seccomp_on) { - if (install_seccomp_filters() < 0) { + if (install_seccomp_filters(INIT, &main_loop_ctx) < 0) { exit(1); } } +#endif if (machine == NULL) { fprintf(stderr, "No machine found.\n"); @@ -3794,6 +3801,14 @@ int main(int argc, char **argv, char **envp) os_setup_post(); +#ifdef CONFIG_SECCOMP + if (seccomp_on) { + if (install_seccomp_filters(MAIN_LOOP, &main_loop_ctx) < 0) { + exit(1); + } + } +#endif + resume_all_vcpus(); main_loop(); bdrv_close_all(); -- 1.7.12