From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:60136) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TXzzz-0003i6-D7 for qemu-devel@nongnu.org; Mon, 12 Nov 2012 14:48:50 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TXzzw-0002mT-8f for qemu-devel@nongnu.org; Mon, 12 Nov 2012 14:48:47 -0500 Received: from e24smtp02.br.ibm.com ([32.104.18.86]:59683) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TXzzv-0002kp-NG for qemu-devel@nongnu.org; Mon, 12 Nov 2012 14:48:44 -0500 Received: from /spool/local by e24smtp02.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 12 Nov 2012 17:48:31 -0200 Received: from d24relay02.br.ibm.com (d24relay02.br.ibm.com [9.13.184.26]) by d24dlp02.br.ibm.com (Postfix) with ESMTP id E4B191DC001A for ; Mon, 12 Nov 2012 14:48:27 -0500 (EST) Received: from d24av01.br.ibm.com (d24av01.br.ibm.com [9.8.31.91]) by d24relay02.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id qACJmKpJ21823506 for ; Mon, 12 Nov 2012 17:48:20 -0200 Received: from d24av01.br.ibm.com (loopback [127.0.0.1]) by d24av01.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id qACJmQSA029409 for ; Mon, 12 Nov 2012 17:48:27 -0200 From: Eduardo Otubo Date: Mon, 12 Nov 2012 17:48:17 -0200 Message-Id: <1352749698-1219-4-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: <1352749698-1219-1-git-send-email-otubo@linux.vnet.ibm.com> References: <1352749698-1219-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCHv3 4/5] seccomp: double whitelist support List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, coreyb@linux.vnet.ibm.com, Eduardo Otubo This patch includes a second whitelist right before the main loop. The second whitelist is more restricted and does not contain execve(). Although it works fine the way it is now, it's optimal to update and fine tune it. v2: * ctx changed to main_loop_ctx * seccomp_on now inside ifdef * open() syscall added to the main_loop whitelist v3: * Main loop now has whitelist without execve(). * Use enum seccomp_states, seccomp_get_state(), and seccomp_install_filter() * Added new syscalls with priority 241 that are unknown to be used by QEMU. We'll attempt to remove these after QEMU 1.3. Signed-off-by: Eduardo Otubo Signed-off-by: Corey Bryant --- qemu-seccomp.c | 252 +++++++++++++++++++++++++++++++++++++++++++++++++++++--- qemu-seccomp.h | 2 +- vl.c | 9 +- 3 files changed, 251 insertions(+), 12 deletions(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 2386996..d5a3b0f 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -13,9 +13,9 @@ * GNU GPL, version 2 or (at your option) any later version. */ #include "config-host.h" -#include #include "osdep.h" #include "qemu-seccomp.h" +#include #ifdef CONFIG_SECCOMP int seccomp_state = SECCOMP_ON; @@ -39,7 +39,7 @@ struct QemuSeccompSyscall { uint8_t priority; }; -static const struct QemuSeccompSyscall seccomp_whitelist[] = { +static const struct QemuSeccompSyscall whitelist_init[] = { { SCMP_SYS(timer_settime), 255 }, { SCMP_SYS(timer_gettime), 254 }, { SCMP_SYS(futex), 253 }, @@ -241,14 +241,238 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(prlimit64), 241 }, { SCMP_SYS(waitid), 241 } }; + +static const struct QemuSeccompSyscall whitelist_main[] = { + { SCMP_SYS(timer_settime), 255 }, + { SCMP_SYS(timer_gettime), 254 }, + { SCMP_SYS(futex), 253 }, + { SCMP_SYS(select), 252 }, +#if defined(__x86_64__) + { SCMP_SYS(recvfrom), 251 }, + { SCMP_SYS(sendto), 250 }, +#elif defined(__i386__) + { SCMP_SYS(socketcall), 250 }, +#endif + { SCMP_SYS(read), 249 }, + { SCMP_SYS(brk), 248 }, + { SCMP_SYS(clone), 247 }, + { SCMP_SYS(mmap), 247 }, + { SCMP_SYS(mprotect), 246 }, + { SCMP_SYS(open), 245 }, + { SCMP_SYS(ioctl), 245 }, +#if defined(__x86_64__) + { SCMP_SYS(socket), 245 }, + { SCMP_SYS(setsockopt), 245 }, + { SCMP_SYS(recvmsg), 245 }, + { SCMP_SYS(sendmsg), 245 }, + { SCMP_SYS(accept), 245 }, + { SCMP_SYS(connect), 245 }, + { SCMP_SYS(socketpair), 245 }, + { SCMP_SYS(bind), 245 }, + { SCMP_SYS(listen), 245 }, + { SCMP_SYS(semget), 245 }, +#elif defined(__i386__) + { SCMP_SYS(ipc), 245 }, +#endif + { SCMP_SYS(gettimeofday), 245 }, + { SCMP_SYS(readlink), 245 }, + { SCMP_SYS(access), 245 }, + { SCMP_SYS(prctl), 245 }, + { SCMP_SYS(signalfd), 245 }, + { SCMP_SYS(getrlimit), 245 }, + { SCMP_SYS(set_tid_address), 245 }, + { SCMP_SYS(statfs), 245 }, + { SCMP_SYS(unlink), 245 }, + { SCMP_SYS(wait4), 245 }, +#if defined(__i386__) + { SCMP_SYS(fcntl64), 245 }, + { SCMP_SYS(fstat64), 245 }, + { SCMP_SYS(stat64), 245 }, + { SCMP_SYS(getgid32), 245 }, + { SCMP_SYS(getegid32), 245 }, + { SCMP_SYS(getuid32), 245 }, + { SCMP_SYS(geteuid32), 245 }, + { SCMP_SYS(sigreturn), 245 }, + { SCMP_SYS(_newselect), 245 }, + { SCMP_SYS(_llseek), 245 }, + { SCMP_SYS(mmap2), 245 }, + { SCMP_SYS(sigprocmask), 245 }, +#endif + { SCMP_SYS(sched_getparam), 245 }, + { SCMP_SYS(sched_getscheduler), 245 }, + { SCMP_SYS(fstat), 245 }, + { SCMP_SYS(clock_getres), 245 }, + { SCMP_SYS(sched_get_priority_min), 245 }, + { SCMP_SYS(sched_get_priority_max), 245 }, + { SCMP_SYS(stat), 245 }, + { SCMP_SYS(uname), 245 }, + { SCMP_SYS(eventfd2), 245 }, + { SCMP_SYS(dup), 245 }, + { SCMP_SYS(dup2), 245 }, + { SCMP_SYS(dup3), 245 }, + { SCMP_SYS(gettid), 245 }, + { SCMP_SYS(getgid), 245 }, + { SCMP_SYS(getegid), 245 }, + { SCMP_SYS(getuid), 245 }, + { SCMP_SYS(geteuid), 245 }, + { SCMP_SYS(timer_create), 245 }, + { SCMP_SYS(exit), 245 }, + { SCMP_SYS(clock_gettime), 245 }, + { SCMP_SYS(time), 245 }, + { SCMP_SYS(restart_syscall), 245 }, + { SCMP_SYS(pwrite64), 245 }, + { SCMP_SYS(chown), 245 }, + { SCMP_SYS(openat), 245 }, + { SCMP_SYS(getdents), 245 }, + { SCMP_SYS(timer_delete), 245 }, + { SCMP_SYS(exit_group), 245 }, + { SCMP_SYS(rt_sigreturn), 245 }, + { SCMP_SYS(sync), 245 }, + { SCMP_SYS(pread64), 245 }, + { SCMP_SYS(madvise), 245 }, + { SCMP_SYS(set_robust_list), 245 }, + { SCMP_SYS(lseek), 245 }, + { SCMP_SYS(pselect6), 245 }, + { SCMP_SYS(fork), 245 }, + { SCMP_SYS(eventfd), 245 }, + { SCMP_SYS(rt_sigprocmask), 245 }, + { SCMP_SYS(write), 244 }, + { SCMP_SYS(fcntl), 243 }, + { SCMP_SYS(tgkill), 242 }, + { SCMP_SYS(rt_sigaction), 242 }, + { SCMP_SYS(pipe2), 242 }, + { SCMP_SYS(munmap), 242 }, + { SCMP_SYS(mremap), 242 }, + { SCMP_SYS(fdatasync), 242 }, + { SCMP_SYS(close), 242 }, + { SCMP_SYS(rt_sigpending), 242 }, + { SCMP_SYS(rt_sigtimedwait), 242 }, + { SCMP_SYS(readv), 242 }, + { SCMP_SYS(writev), 242 }, + { SCMP_SYS(preadv), 242 }, + { SCMP_SYS(pwritev), 242 }, + { SCMP_SYS(setrlimit), 242 }, + { SCMP_SYS(ftruncate), 242 }, + { SCMP_SYS(lstat), 242 }, + { SCMP_SYS(pipe), 242 }, + { SCMP_SYS(umask), 242 }, + { SCMP_SYS(chdir), 242 }, + { SCMP_SYS(setitimer), 242 }, + { SCMP_SYS(setsid), 242 }, + { SCMP_SYS(poll), 242 }, +#if defined(__i386__) + { SCMP_SYS(waitpid), 242 }, +#elif defined(__x86_64__) + { SCMP_SYS(getsockname), 242 }, + { SCMP_SYS(getpeername), 242 }, + { SCMP_SYS(accept4), 242 }, + { SCMP_SYS(newfstatat), 241 }, + { SCMP_SYS(shutdown), 241 }, + { SCMP_SYS(getsockopt), 241 }, + { SCMP_SYS(semctl), 241 }, + { SCMP_SYS(semop), 241 }, + { SCMP_SYS(semtimedop), 241 }, +#endif + { SCMP_SYS(ppoll), 241 }, + { SCMP_SYS(creat), 241 }, + { SCMP_SYS(link), 241 }, + { SCMP_SYS(getpid), 241 }, + { SCMP_SYS(getppid), 241 }, + { SCMP_SYS(getpgrp), 241 }, + { SCMP_SYS(getpgid), 241 }, + { SCMP_SYS(getsid), 241 }, + { SCMP_SYS(getdents64), 241 }, + { SCMP_SYS(getresuid), 241 }, + { SCMP_SYS(getresgid), 241 }, + { SCMP_SYS(getgroups), 241 }, +#if defined(__i386__) + { SCMP_SYS(getresuid32), 241 }, + { SCMP_SYS(getresgid32), 241 }, + { SCMP_SYS(getgroups32), 241 }, + { SCMP_SYS(signal), 241 }, + { SCMP_SYS(sigaction), 241 }, + { SCMP_SYS(sigsuspend), 241 }, + { SCMP_SYS(sigpending), 241 }, + { SCMP_SYS(truncate64), 241 }, + { SCMP_SYS(ftruncate64), 241 }, + { SCMP_SYS(fchown32), 241 }, + { SCMP_SYS(chown32), 241 }, + { SCMP_SYS(lchown32), 241 }, + { SCMP_SYS(statfs64), 241 }, + { SCMP_SYS(fstatfs64), 241 }, + { SCMP_SYS(fstatat64), 241 }, + { SCMP_SYS(lstat64), 241 }, + { SCMP_SYS(sendfile64), 241 }, + { SCMP_SYS(ugetrlimit), 241 }, +#endif + { SCMP_SYS(alarm), 241 }, + { SCMP_SYS(rt_sigsuspend), 241 }, + { SCMP_SYS(rt_sigqueueinfo), 241 }, + { SCMP_SYS(rt_tgsigqueueinfo), 241 }, + { SCMP_SYS(sigaltstack), 241 }, + { SCMP_SYS(signalfd4), 241 }, + { SCMP_SYS(truncate), 241 }, + { SCMP_SYS(fchown), 241 }, + { SCMP_SYS(lchown), 241 }, + { SCMP_SYS(fchownat), 241 }, + { SCMP_SYS(fstatfs), 241 }, + { SCMP_SYS(sendfile), 241 }, + { SCMP_SYS(getitimer), 241 }, + { SCMP_SYS(syncfs), 241 }, + { SCMP_SYS(fsync), 241 }, + { SCMP_SYS(fchdir), 241 }, + { SCMP_SYS(flock), 241 }, + { SCMP_SYS(msync), 241 }, + { SCMP_SYS(sched_setparam), 241 }, + { SCMP_SYS(sched_setscheduler), 241 }, + { SCMP_SYS(sched_yield), 241 }, + { SCMP_SYS(sched_rr_get_interval), 241 }, + { SCMP_SYS(sched_setaffinity), 241 }, + { SCMP_SYS(sched_getaffinity), 241 }, + { SCMP_SYS(readahead), 241 }, + { SCMP_SYS(timer_getoverrun), 241 }, + { SCMP_SYS(unlinkat), 241 }, + { SCMP_SYS(readlinkat), 241 }, + { SCMP_SYS(faccessat), 241 }, + { SCMP_SYS(get_robust_list), 241 }, + { SCMP_SYS(splice), 241 }, + { SCMP_SYS(vmsplice), 241 }, + { SCMP_SYS(getcpu), 241 }, + { SCMP_SYS(sendmmsg), 241 }, + { SCMP_SYS(recvmmsg), 241 }, + { SCMP_SYS(prlimit64), 241 }, + { SCMP_SYS(waitid), 241 } +}; #endif -int seccomp_install_filter(void) +#ifdef CONFIG_SECCOMP +static int process_list(scmp_filter_ctx *ctx, + const struct QemuSeccompSyscall *list, + unsigned int list_size) { int rc = 0; -#ifdef CONFIG_SECCOMP unsigned int i = 0; - scmp_filter_ctx ctx; + + for (i = 0; i < list_size; i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, list[i].num, 0); + if (rc < 0) { + return rc; + } + + rc = seccomp_syscall_priority(ctx, list[i].num, list[i].priority); + if (rc < 0) { + return rc; + } + } + return rc; +} +#endif + +int seccomp_install_filter(int state) +{ + int rc = 0; +#ifdef CONFIG_SECCOMP + scmp_filter_ctx ctx = NULL; ctx = seccomp_init(SCMP_ACT_KILL); if (ctx == NULL) { @@ -256,21 +480,29 @@ int seccomp_install_filter(void) goto seccomp_return; } - for (i = 0; i < ARRAY_SIZE(seccomp_whitelist); i++) { - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, seccomp_whitelist[i].num, 0); + switch (state) { + case SECCOMP_INIT: + rc = process_list(ctx, whitelist_init, ARRAY_SIZE(whitelist_init)); if (rc < 0) { goto seccomp_return; } - rc = seccomp_syscall_priority(ctx, seccomp_whitelist[i].num, - seccomp_whitelist[i].priority); + break; + case SECCOMP_MAIN_LOOP: + rc = process_list(ctx, whitelist_main, ARRAY_SIZE(whitelist_main)); if (rc < 0) { goto seccomp_return; } + break; + default: + rc = -1; + goto seccomp_return; } - rc = seccomp_load(ctx); seccomp_return: + if (rc == 0) { + seccomp_set_state(state); + } seccomp_release(ctx); #endif return rc; diff --git a/qemu-seccomp.h b/qemu-seccomp.h index 686db09..029c111 100644 --- a/qemu-seccomp.h +++ b/qemu-seccomp.h @@ -28,6 +28,6 @@ enum seccomp_states { void seccomp_set_state(int); int seccomp_get_state(void); -int seccomp_install_filter(void); +int seccomp_install_filter(int); #endif diff --git a/vl.c b/vl.c index cb3d85e..80b1fff 100644 --- a/vl.c +++ b/vl.c @@ -3483,7 +3483,7 @@ int main(int argc, char **argv, char **envp) } if (seccomp_get_state() == SECCOMP_ON) { - if (seccomp_install_filter() < 0) { + if (seccomp_install_filter(SECCOMP_INIT) < 0) { fprintf(stderr, "failed to install seccomp syscall " "initialization filter\n"); exit(1); @@ -3945,6 +3945,13 @@ int main(int argc, char **argv, char **envp) os_setup_post(); resume_all_vcpus(); + if (seccomp_get_state() >= SECCOMP_ON) { + if (seccomp_install_filter(SECCOMP_MAIN_LOOP) < 0) { + fprintf(stderr, + "failed to install seccomp syscall main loop filter\n"); + exit(1); + } + } main_loop(); bdrv_close_all(); pause_all_vcpus(); -- 1.7.10.4