From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36824) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VU1R7-0008BA-J6 for qemu-devel@nongnu.org; Wed, 09 Oct 2013 17:36:59 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VU1R1-0003Fp-KG for qemu-devel@nongnu.org; Wed, 09 Oct 2013 17:36:53 -0400 Received: from mx1.redhat.com ([209.132.183.28]:43025) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VU1R1-0003Fa-Bp for qemu-devel@nongnu.org; Wed, 09 Oct 2013 17:36:47 -0400 From: Paul Moore Date: Wed, 09 Oct 2013 17:36:38 -0400 Message-ID: <1559837.J1S2UnvGH4@sifl> In-Reply-To: <1381279346-23676-2-git-send-email-otubo@linux.vnet.ibm.com> References: <1381279346-23676-1-git-send-email-otubo@linux.vnet.ibm.com> <1381279346-23676-2-git-send-email-otubo@linux.vnet.ibm.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Subject: Re: [Qemu-devel] [PATCHv3 1/3] seccomp: adding blacklist support List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo Cc: coreyb@linux.vnet.ibm.com, qemu-devel@nongnu.org, anthony@codemonkey.ws On Tuesday, October 08, 2013 09:42:24 PM Eduardo Otubo wrote: > v3: The "-netdev tap" option is checked in the vl.c file during the > process of the command line argument list. It sets tap_enabled to true > or false according to the configuration found. Later at the seccomp > filter installation, this value is checked wheter to install or not this > feature. I like the idea of slowly making the QEMU syscall filter dependent on the runtime configuration. With that in mind, I wonder if we should have a more general purpose API in include/sysemu/seccomp.h that allows QEMU to indicate to the the QEMU/seccomp code that a particular feature is enabled. Maybe something like this: #define SCMP_FEAT_TAP ... int seccomp_feature_enable(int feature); One more comment below. > Adding a system call blacklist right before the vcpus starts. This > filter is composed by the system calls that can't be executed after the > guests are up. This list should be refined as whitelist is, with as much > testing as we can do using virt-test. > > Signed-off-by: Eduardo Otubo > --- > include/sysemu/seccomp.h | 6 ++++- > qemu-seccomp.c | 64 > +++++++++++++++++++++++++++++++++++++++--------- vl.c | > 21 +++++++++++++++- > 3 files changed, 77 insertions(+), 14 deletions(-) > > diff --git a/include/sysemu/seccomp.h b/include/sysemu/seccomp.h > index 1189fa2..9dc7e52 100644 > --- a/include/sysemu/seccomp.h > +++ b/include/sysemu/seccomp.h > @@ -15,8 +15,12 @@ > #ifndef QEMU_SECCOMP_H > #define QEMU_SECCOMP_H > > +#define WHITELIST 0 > +#define BLACKLIST 1 Should these #defines be namespaced in some way, e.g. SCMP_LIST_BLACKLIST? > #include > #include "qemu/osdep.h" > > -int seccomp_start(void); > +int seccomp_start(int list_type); > + > #endif -- paul moore security and virtualization @ redhat