From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:44677) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VThre-0006Qg-MT for qemu-devel@nongnu.org; Tue, 08 Oct 2013 20:43:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VThrT-0008Qd-5L for qemu-devel@nongnu.org; Tue, 08 Oct 2013 20:42:58 -0400 Received: from e24smtp03.br.ibm.com ([32.104.18.24]:35545) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VThrS-0008Q7-NP for qemu-devel@nongnu.org; Tue, 08 Oct 2013 20:42:47 -0400 Received: from /spool/local by e24smtp03.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 8 Oct 2013 21:42:45 -0300 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp02.br.ibm.com (Postfix) with ESMTP id F40D81DC006D for ; Tue, 8 Oct 2013 20:42:40 -0400 (EDT) Received: from d24av01.br.ibm.com (d24av01.br.ibm.com [9.8.31.91]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r990bKsi2850898 for ; Tue, 8 Oct 2013 21:37:20 -0300 Received: from d24av01.br.ibm.com (localhost [127.0.0.1]) by d24av01.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r990gdIQ006739 for ; Tue, 8 Oct 2013 21:42:40 -0300 From: Eduardo Otubo Date: Tue, 8 Oct 2013 21:42:23 -0300 Message-Id: <1381279346-23676-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCHv3 0/3] seccomp: adding blacklist support with command line List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, coreyb@linux.vnet.ibm.com, anthony@codemonkey.ws, Eduardo Otubo v3: The "-netdev tap" option is checked in order to decide if the blacklist is eligible to be installed or not, since it's one the most used features that is known to use the exec() system call. It's an automatic mechanism to avoid Qemu to break when using the blacklist feature. v2: The blacklist works exactly the opposite as the whitelist. I set the default behaiour to SCMP_ACT_ALLOW and the exceptions to SCMP_ACT_KILL; remembering it inherits the behavior from the previous installed whitelist. v1: The second whitelist is installed right before the vcpu starts, it contains all the system calls the first one has except for exec() and select(), which are big major syscalls that I could extensively test with virt-test and do not cause any damage to the general execution. This patch series also contain the command line support for this feature and some minor fixes, all of them described in their own commit messages. The environment in which the second whitelist is installed seems to need less system calls than the first, so the procedure here will be the same: Keep testing with virt-test and get to the smallest list as possible. Eduardo Otubo (3): seccomp: adding blacklist support seccomp: adding command line support for blacklist seccomp: general fixes include/sysemu/seccomp.h | 6 ++++- qemu-options.hx | 8 +++--- qemu-seccomp.c | 66 ++++++++++++++++++++++++++++++++++++++---------- vl.c | 42 +++++++++++++++++++++++++++--- 4 files changed, 101 insertions(+), 21 deletions(-) -- 1.8.3.1