From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:38456) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VFQgx-0001Ou-BK for qemu-devel@nongnu.org; Fri, 30 Aug 2013 11:33:01 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VFQgq-0001Sr-Ty for qemu-devel@nongnu.org; Fri, 30 Aug 2013 11:32:55 -0400 Received: from mx1.redhat.com ([209.132.183.28]:7467) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VFQgq-0001Sd-Mo for qemu-devel@nongnu.org; Fri, 30 Aug 2013 11:32:48 -0400 From: Paul Moore Date: Fri, 30 Aug 2013 11:32:43 -0400 Message-ID: <1424756.02OYxZYj2d@sifl> In-Reply-To: <5220ABD0.7000802@linux.vnet.ibm.com> References: <1377738272-3470-1-git-send-email-otubo@linux.vnet.ibm.com> <2886554.JWDlXEmk61@sifl> <5220ABD0.7000802@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Subject: Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo Cc: coreyb@linux.vnet.ibm.com, wad@chromium.org, qemu-devel@nongnu.org On Friday, August 30, 2013 11:27:28 AM Eduardo Otubo wrote: > On 08/29/2013 09:56 AM, Paul Moore wrote: > > On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: > >> Now there's a second whitelist, right before the vcpu starts. The second > >> whitelist is the same as the first one, except for exec() and select(). > >> > >> Signed-off-by: Eduardo Otubo > > > > We talked about this in a previous thread, but as a reminder, the kernel's > > seccomp BPF filter works by executing all of the loaded filters for each > > syscall and taking the least permissive action for all of the results. In > > other words, if one filter returns ALLOW for a given syscall and another > > filter returns KILL, the kernel will select the KILL action for the > > syscall. > > > > With that in mind, I think the best option is to keep the existing > > whitelist and instead of creating a second whitelist, create a second > > *blacklist* that removes the syscalls you don't want to allow anymore, > > e.g. exec() and select(). This approach should be easier to maintain and > > would result in less overhead in the kernel's seccomp evaluator (the > > blacklist filter would be much smaller than a second whitelist filter). > > You're correct. I was thinking in a whole other approach, but your point > makes a lot more sense. As I mentioned on the IRC, I should call > seccomp_init(SCMP_ACT_ALLOW) and seccomp_rule_add(ctx, SCMP_ACT_KILL, > list[i].num, 0); is that correct? Yes, just basically swap the actions. Also, as an FYI, while I may be in the IRC room, I typically don't actually monitor the room unless you direct a comment at me (it starts blinking and grabs my attention). -- paul moore security and virtualization @ redhat