From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:48629) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZaTXK-00027q-QU for qemu-devel@nongnu.org; Fri, 11 Sep 2015 14:59:03 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZaTXH-0001TL-Ll for qemu-devel@nongnu.org; Fri, 11 Sep 2015 14:59:02 -0400 Received: from mx1.redhat.com ([209.132.183.28]:57982) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZaTXH-0001TA-GM for qemu-devel@nongnu.org; Fri, 11 Sep 2015 14:58:59 -0400 From: Paul Moore Date: Fri, 11 Sep 2015 14:58:56 -0400 Message-ID: <1978729.K9nur9QBLH@sifl> In-Reply-To: <20150910144852.GM11366@redhat.com> References: <20150910144852.GM11366@redhat.com> MIME-Version: 1.0 Content-Transfer-Encoding: 7Bit Content-Type: text/plain; charset="us-ascii" Subject: Re: [Qemu-devel] [PATCH] Add a few argument filters to the seccomp sandbox List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: namnamc@safe-mail.net, qemu-devel@nongnu.org, eduardo.otubo@profitbricks.com On Thursday, September 10, 2015 03:48:52 PM Daniel P. Berrange wrote: > On Wed, Sep 09, 2015 at 09:55:33PM -0400, namnamc@Safe-mail.net wrote: > > + > > + /* shmget */ > > + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2, > > + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE), > > + SCMP_A2(SCMP_CMP_EQ, IP_CREAT|0777)); > > I'm not familiar with semantics of these seccomp rules, but is this > saying that the second arg must be exactly equal to IP_CREAT|0777 ? Yes. > If the app passes IP_CREAT|0600, would that be permitted instead ? > The latter is what I see gtk2 source code passing for mode. It wouldn't match the rule as written above, if it doesn't match any other configured rules it would hit the default filter action. -- paul moore security @ redhat