Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

[Paul Moore <pmoore@redhat.com>]

On Friday, August 30, 2013 11:27:28 AM Eduardo Otubo wrote:
> On 08/29/2013 09:56 AM, Paul Moore wrote:
> > On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote:
> >> Now there's a second whitelist, right before the vcpu starts. The second
> >> whitelist is the same as the first one, except for exec() and select().
> >> 
> >> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> > 
> > We talked about this in a previous thread, but as a reminder, the kernel's
> > seccomp BPF filter works by executing all of the loaded filters for each
> > syscall and taking the least permissive action for all of the results.  In
> > other words, if one filter returns ALLOW for a given syscall and another
> > filter returns KILL, the kernel will select the KILL action for the
> > syscall.
> > 
> > With that in mind, I think the best option is to keep the existing
> > whitelist and instead of creating a second whitelist, create a second
> > *blacklist* that removes the syscalls you don't want to allow anymore,
> > e.g. exec() and select().  This approach should be easier to maintain and
> > would result in less overhead in the kernel's seccomp evaluator (the
> > blacklist filter would be much smaller than a second whitelist filter).
> 
> You're correct. I was thinking in a whole other approach, but your point
> makes a lot more sense. As I mentioned on the IRC, I should call
> seccomp_init(SCMP_ACT_ALLOW) and seccomp_rule_add(ctx, SCMP_ACT_KILL,
> list[i].num, 0); is that correct?

Yes, just basically swap the actions.

Also, as an FYI, while I may be in the IRC room, I typically don't actually 
monitor the room unless you direct a comment at me (it starts blinking and 
grabs my attention).

-- 
paul moore
security and virtualization @ redhat