From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:54874) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VYa2I-0002b4-5s for qemu-devel@nongnu.org; Tue, 22 Oct 2013 07:22:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VYa2A-0001Gg-JG for qemu-devel@nongnu.org; Tue, 22 Oct 2013 07:22:06 -0400 Received: from e24smtp05.br.ibm.com ([32.104.18.26]:55140) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VYa2A-0001G1-61 for qemu-devel@nongnu.org; Tue, 22 Oct 2013 07:21:58 -0400 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 22 Oct 2013 09:21:52 -0200 Received: from d24relay02.br.ibm.com (d24relay02.br.ibm.com [9.13.184.26]) by d24dlp02.br.ibm.com (Postfix) with ESMTP id 6A03E1DC006E for ; Tue, 22 Oct 2013 07:21:48 -0400 (EDT) Received: from d24av04.br.ibm.com (d24av04.br.ibm.com [9.8.31.97]) by d24relay02.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r9MBLkLD50397348 for ; Tue, 22 Oct 2013 09:21:47 -0200 Received: from d24av04.br.ibm.com (localhost [127.0.0.1]) by d24av04.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r9MBLlTe031228 for ; Tue, 22 Oct 2013 09:21:47 -0200 From: Eduardo Otubo Date: Tue, 22 Oct 2013 09:21:46 -0200 Message-Id: <1382440906-3852-1-git-send-email-otubo@linux.vnet.ibm.com> Subject: [Qemu-devel] [PATCH for-1.7] seccomp: setting "-sandbox on" by default List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: pmoore@redhat.com, coreyb@linux.vnet.ibm.com, anthony@codemonkey.ws, Eduardo Otubo Inverting the way sandbox handles arguments, making possible to have no argument and still have '-sandbox on' enabled. Signed-off-by: Eduardo Otubo --- The option '-sandbox on' is now used by default by virt-test[0] -- it has been merged into the 'next' branch and will be available in the next release, meaning we have a back support for regression tests if anything breaks because of some missing system call not listed in the whitelist. This being said, I think it makes sense to have this option set to 'on' by default in the next Qemu version. It's been a while since no missing syscall is reported and at this point the whitelist seems to be pretty mature. [0] - https://github.com/autotest/virt-test/commit/50e1f7d47a94f4c770880cd8ec0f18365dcba714 qemu-options.hx | 4 ++-- vl.c | 47 ++++++++++++++++++++++++++++------------------- 2 files changed, 30 insertions(+), 21 deletions(-) diff --git a/qemu-options.hx b/qemu-options.hx index 5dc8b75..315a86d 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2982,13 +2982,13 @@ Old param mode (ARM only). ETEXI DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \ - "-sandbox Enable seccomp mode 2 system call filter (default 'off').\n", + "-sandbox Enable seccomp mode 2 system call filter (default 'on').\n", QEMU_ARCH_ALL) STEXI @item -sandbox @var{arg} @findex -sandbox Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will -disable it. The default is 'off'. +disable it. The default is 'on'. ETEXI DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig, diff --git a/vl.c b/vl.c index b42ac67..ae3bdc9 100644 --- a/vl.c +++ b/vl.c @@ -529,6 +529,20 @@ static QemuOptsList qemu_msg_opts = { }, }; +static QemuOpts *qemu_get_sandbox_opts(void) +{ + QemuOptsList *list; + QemuOpts *opts; + + list = qemu_find_opts("sandbox"); + assert(list); + opts = qemu_opts_find(list, NULL); + if (!opts) { + opts = qemu_opts_create_nofail(list); + } + return opts; +} + /** * Get machine options * @@ -960,24 +974,9 @@ static int bt_parse(const char *opt) return 1; } -static int parse_sandbox(QemuOpts *opts, void *opaque) +static bool sandbox_enabled(bool default_usb) { - /* FIXME: change this to true for 1.3 */ - if (qemu_opt_get_bool(opts, "enable", false)) { -#ifdef CONFIG_SECCOMP - if (seccomp_start() < 0) { - qerror_report(ERROR_CLASS_GENERIC_ERROR, - "failed to install seccomp syscall filter in the kernel"); - return -1; - } -#else - qerror_report(ERROR_CLASS_GENERIC_ERROR, - "sandboxing request but seccomp is not compiled into this build"); - return -1; -#endif - } - - return 0; + return qemu_opt_get_bool(qemu_get_sandbox_opts(), "sandbox", default_usb); } bool usb_enabled(bool default_usb) @@ -3806,8 +3805,18 @@ int main(int argc, char **argv, char **envp) exit(1); } - if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL, 0)) { - exit(1); + if (sandbox_enabled(true)) { +#ifdef CONFIG_SECCOMP + if (seccomp_start() < 0) { + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "failed to install seccomp syscall filter in the kernel"); + return -1; + } +#else + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "sandboxing request but seccomp is not compiled into this build"); + return -1; +#endif } #ifndef _WIN32 -- 1.8.3.1