* [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp
@ 2012-06-21 22:10 Eduardo Otubo
2012-06-21 22:10 ` [Qemu-devel] [PATCH 1/2] Adding support for libseccomp in configure and Makefile Eduardo Otubo
` (2 more replies)
0 siblings, 3 replies; 6+ messages in thread
From: Eduardo Otubo @ 2012-06-21 22:10 UTC (permalink / raw)
To: qemu-devel; +Cc: Eduardo Otubo
Hello all,
This is the third effort to sandbox Qemu guests using Libseccomp[0]. The
patches that follows are pretty simple and straightforward. I added the correct
options and checks to the configure script and the basic calls to libseccomp in
the main loop at vl.c. Details of each one are in the emails of the patch set.
v2: The code now is separated in the files qemu-seccomp.c and qemu-seccomp.h
for a cleaner implementation.
This support limits the system call footprint of the entire QEMU process to a
limited set of syscalls, those that we know QEMU uses. The idea is to limit
the allowable syscalls, therefore limiting the impact that an attacked guest
could have on the host system.
It's important to note that the libseccomp itself needs the seccomp mode 2
feature in the kernel, which is pretty close to get to the mainline since it's
already been accepted to the linux-next branch[1].
v2: I also tested with the 3.5-rc1 kernel, which is the one with seccomp mode 2
support. Everything went fine.
v3: As we discussed in previous emails in this very mailing list, this feature
is not supposed to replace existing security feature, but add another layer to
the whole. The whitelist should contain all the syscalls QEMU needs, so its
execution won't be affected, just safer. And as stated by Will Drewry's commit
message[1]: "Filter programs will be inherited across fork/clone and execve.",
the same white list should be passed along from the father process to the
child, then execve() shouldn't be a problem.
As always, comments are more than welcome.
Regards,
[0] - Now you don't need to git clone anymore, you can download the first
release - http://sourceforge.net/projects/libseccomp/
[1] - http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=commit;h=e2cfabdfd075648216f99c2c03821cf3f47c1727
Eduardo Otubo (2):
Adding support for libseccomp in configure and Makefile
Creating qemu-seccomp.[ch] and adding call to vl.c
Makefile.objs | 4 +++
configure | 23 +++++++++++++++
qemu-seccomp.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++
qemu-seccomp.h | 23 +++++++++++++++
vl.c | 11 +++++++
5 files changed, 149 insertions(+)
create mode 100644 qemu-seccomp.c
create mode 100644 qemu-seccomp.h
--
1.7.9.5
^ permalink raw reply [flat|nested] 6+ messages in thread* [Qemu-devel] [PATCH 1/2] Adding support for libseccomp in configure and Makefile 2012-06-21 22:10 [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo @ 2012-06-21 22:10 ` Eduardo Otubo 2012-06-21 22:10 ` [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c Eduardo Otubo 2012-06-22 12:17 ` [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo 2 siblings, 0 replies; 6+ messages in thread From: Eduardo Otubo @ 2012-06-21 22:10 UTC (permalink / raw) To: qemu-devel; +Cc: Eduardo Otubo Adding basic options to the configure script to use libseccomp or not. The default is set to 'no'. If the flag --enable-libseccomp is used, the script will check for its existence using pkg-config. v2: * As I removed all the code related to seccomp from vl.c, I created qemu-seccomp.[ch]. * Also making the configure script to add the specific line to Makefile.obj in order to compile with appropriate support to seccomp. v3: * Removing the line from Makefile.obj and adding it to Makefile.objs. * Marking libseccomp default option to 'yes' in the configure script. Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> --- Makefile.objs | 4 ++++ configure | 23 +++++++++++++++++++++++ 2 files changed, 27 insertions(+) diff --git a/Makefile.objs b/Makefile.objs index 74110dd..c0620bf 100644 --- a/Makefile.objs +++ b/Makefile.objs @@ -95,6 +95,10 @@ common-obj-y += qemu-timer.o qemu-timer-common.o common-obj-$(CONFIG_SLIRP) += slirp/ ###################################################################### +# libseccomp +common-obj-$(CONFIG_LIBSECCOMP) += qemu-seccomp.o + +###################################################################### # libuser user-obj-y = diff --git a/configure b/configure index b68c0ca..ec5c66d 100755 --- a/configure +++ b/configure @@ -195,6 +195,7 @@ zlib="yes" guest_agent="yes" libiscsi="" coroutine="" +libseccomp="yes" # parse CC options first for opt do @@ -824,6 +825,10 @@ for opt do ;; --disable-guest-agent) guest_agent="no" ;; + --enable-libseccomp) libseccomp="yes" + ;; + --disable-libseccomp) libseccomp="no" + ;; *) echo "ERROR: unknown option $opt"; show_help="yes" ;; esac @@ -1108,6 +1113,8 @@ echo " --disable-usb-redir disable usb network redirection support" echo " --enable-usb-redir enable usb network redirection support" echo " --disable-guest-agent disable building of the QEMU Guest Agent" echo " --enable-guest-agent enable building of the QEMU Guest Agent" +echo " --disable-libseccomp disable libseccomp support" +echo " --enable-libseccomp enable libseccomp support" echo " --with-coroutine=BACKEND coroutine backend. Supported options:" echo " gthread, ucontext, sigaltstack, windows" echo "" @@ -1353,6 +1360,17 @@ EOF fi ########################################## +# libseccomp check + +if test "$libseccomp" = "yes" ; then + if $pkg_config libseccomp --modversion >/dev/null 2>&1; then + LIBS=`$pkg_config --libs libseccomp` + else + feature_not_found "libseccomp" + fi +fi + +########################################## # xen probe if test "$xen" != "no" ; then @@ -3036,6 +3054,7 @@ echo "usb net redir $usb_redir" echo "OpenGL support $opengl" echo "libiscsi support $libiscsi" echo "build guest agent $guest_agent" +echo "seccomp support $libseccomp" echo "coroutine backend $coroutine_backend" if test "$sdl_too_old" = "yes"; then @@ -3337,6 +3356,10 @@ if test "$libiscsi" = "yes" ; then echo "CONFIG_LIBISCSI=y" >> $config_host_mak fi +if test "$libseccomp" = "yes" ; then + echo "CONFIG_LIBSECCOMP=y" >> $config_host_mak +fi + # XXX: suppress that if [ "$bsd" = "yes" ] ; then echo "CONFIG_BSD=y" >> $config_host_mak -- 1.7.9.5 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c 2012-06-21 22:10 [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo 2012-06-21 22:10 ` [Qemu-devel] [PATCH 1/2] Adding support for libseccomp in configure and Makefile Eduardo Otubo @ 2012-06-21 22:10 ` Eduardo Otubo 2012-06-22 8:29 ` Stefan Hajnoczi 2012-06-24 6:08 ` Blue Swirl 2012-06-22 12:17 ` [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo 2 siblings, 2 replies; 6+ messages in thread From: Eduardo Otubo @ 2012-06-21 22:10 UTC (permalink / raw) To: qemu-devel; +Cc: Eduardo Otubo I added a syscall struct using priority levels as described in the libseccomp man page. The priority numbers are based to the frequency they appear in a sample strace from a regular qemu guest run under libvirt. Libseccomp generates linear BPF code to filter system calls, those rules are read one after another. The priority system places the most common rules first in order to reduce the overhead when processing them. v2: * Fixed some style issues * Removed code from vl.c and created qemu-seccomp.[ch] * Now using ARRAY_SIZE macro * Added more syscalls without priority/frequency set yet v3: * Adding copyright and license information * Replacing seccomp_whitelist_count just by ARRAY_SIZE * Adding header protection to qemu-seccomp.h * Moving QemuSeccompSyscall definition to qemu-seccomp.c * Negative return from seccomp_start is fatal now. * Adding open() and execve() to the whitelis The whitelist is getting bigger and complete, maybe it's time to drop the RFC tag. Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> --- qemu-seccomp.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ qemu-seccomp.h | 23 +++++++++++++++ vl.c | 11 +++++++ 3 files changed, 122 insertions(+) create mode 100644 qemu-seccomp.c create mode 100644 qemu-seccomp.h diff --git a/qemu-seccomp.c b/qemu-seccomp.c new file mode 100644 index 0000000..0442348 --- /dev/null +++ b/qemu-seccomp.c @@ -0,0 +1,88 @@ +/* + * QEMU seccomp mode 2 support with libseccomp + * + * Copyright IBM, Corp. 2012 + * + * Authors: + * Eduardo Otubo <eotubo@br.ibm.com> + * + * This work is licensed under the terms of the GNU GPL, version 2. See + * the COPYING file in the top-level directory. + * + * Contributions after 2012-01-13 are licensed under the terms of the + * GNU GPL, version 2 or (at your option) any later version. + */ +#include <stdio.h> +#include <seccomp.h> +#include "qemu-seccomp.h" + +struct QemuSeccompSyscall { + int32_t num; + uint8_t priority; +}; + +const static struct QemuSeccompSyscall seccomp_whitelist[] = { + { SCMP_SYS(timer_settime), 255 }, + { SCMP_SYS(timer_gettime), 254 }, + { SCMP_SYS(futex), 253 }, + { SCMP_SYS(select), 252 }, + { SCMP_SYS(recvfrom), 251 }, + { SCMP_SYS(sendto), 250 }, + { SCMP_SYS(read), 249 }, + { SCMP_SYS(brk), 248 }, + { SCMP_SYS(clone), 247 }, + { SCMP_SYS(mmap), 247 }, + { SCMP_SYS(mprotect), 246 }, + { SCMP_SYS(execve), 245 }, + { SCMP_SYS(open), 245 }, + { SCMP_SYS(ioctl), 245 }, + { SCMP_SYS(recvmsg), 245 }, + { SCMP_SYS(sendmsg), 245 }, + { SCMP_SYS(accept), 245 }, + { SCMP_SYS(connect), 245 }, + { SCMP_SYS(bind), 245 }, + { SCMP_SYS(listen), 245 }, + { SCMP_SYS(ioctl), 245 }, + { SCMP_SYS(eventfd), 245 }, + { SCMP_SYS(rt_sigprocmask), 245 }, + { SCMP_SYS(write), 244 }, + { SCMP_SYS(fcntl), 243 }, + { SCMP_SYS(tgkill), 242 }, + { SCMP_SYS(rt_sigaction), 242 }, + { SCMP_SYS(pipe2), 242 }, + { SCMP_SYS(munmap), 242 }, + { SCMP_SYS(mremap), 242 }, + { SCMP_SYS(getsockname), 242 }, + { SCMP_SYS(getpeername), 242 }, + { SCMP_SYS(fdatasync), 242 }, + { SCMP_SYS(close), 242 } +}; + +int seccomp_start(void) +{ + int rc = 0; + unsigned int i = 0; + + rc = seccomp_init(SCMP_ACT_KILL); + if (rc < 0) { + goto seccomp_return; + } + + for (i = 0; i < ARRAY_SIZE(seccomp_whitelist); i++) { + rc = seccomp_rule_add(SCMP_ACT_ALLOW, seccomp_whitelist[i].num, 0); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_syscall_priority(seccomp_whitelist[i].num, + seccomp_whitelist[i].priority); + if (rc < 0) { + goto seccomp_return; + } + } + + rc = seccomp_load(); + + seccomp_return: + seccomp_release(); + return rc; +} diff --git a/qemu-seccomp.h b/qemu-seccomp.h new file mode 100644 index 0000000..3253786 --- /dev/null +++ b/qemu-seccomp.h @@ -0,0 +1,23 @@ +/* + * QEMU seccomp mode 2 support with libseccomp + * + * Copyright IBM, Corp. 2012 + * + * Authors: + * Eduardo Otubo <eotubo@br.ibm.com> + * + * This work is licensed under the terms of the GNU GPL, version 2. See + * the COPYING file in the top-level directory. + * + * Contributions after 2012-01-13 are licensed under the terms of the + * GNU GPL, version 2 or (at your option) any later version. + */ +#ifndef CONFIG_LIBSECCOMP +#define CONFIG_LIBSECCOMP + +#include <seccomp.h> +#include "osdep.h" + +int seccomp_start(void); + +#endif diff --git a/vl.c b/vl.c index 1329c30..83526f1 100644 --- a/vl.c +++ b/vl.c @@ -62,6 +62,9 @@ #include <linux/ppdev.h> #include <linux/parport.h> #endif +#ifdef CONFIG_LIBSECCOMP +#include "qemu-seccomp.h" +#endif #ifdef __sun__ #include <sys/stat.h> #include <sys/ethernet.h> @@ -2296,6 +2299,14 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; +#ifdef CONFIG_LIBSECCOMP + if (seccomp_start() < 0) { + fprintf(stderr, + "failed to configure the seccomp syscall filter in the kernel\n"); + exit(1); + } +#endif + atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]); -- 1.7.9.5 ^ permalink raw reply related [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c 2012-06-21 22:10 ` [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c Eduardo Otubo @ 2012-06-22 8:29 ` Stefan Hajnoczi 2012-06-24 6:08 ` Blue Swirl 1 sibling, 0 replies; 6+ messages in thread From: Stefan Hajnoczi @ 2012-06-22 8:29 UTC (permalink / raw) To: Eduardo Otubo; +Cc: qemu-devel On Thu, Jun 21, 2012 at 11:10 PM, Eduardo Otubo <otubo@linux.vnet.ibm.com> wrote: > I added a syscall struct using priority levels as described in the > libseccomp man page. The priority numbers are based to the frequency > they appear in a sample strace from a regular qemu guest run under > libvirt. > > Libseccomp generates linear BPF code to filter system calls, those rules > are read one after another. The priority system places the most common > rules first in order to reduce the overhead when processing them. > > v2: > * Fixed some style issues > * Removed code from vl.c and created qemu-seccomp.[ch] > * Now using ARRAY_SIZE macro > * Added more syscalls without priority/frequency set yet > > v3: > * Adding copyright and license information > * Replacing seccomp_whitelist_count just by ARRAY_SIZE > * Adding header protection to qemu-seccomp.h > * Moving QemuSeccompSyscall definition to qemu-seccomp.c > * Negative return from seccomp_start is fatal now. > * Adding open() and execve() to the whitelis > > The whitelist is getting bigger and complete, maybe it's time to drop > the RFC tag. > > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> > --- > qemu-seccomp.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > qemu-seccomp.h | 23 +++++++++++++++ > vl.c | 11 +++++++ > 3 files changed, 122 insertions(+) > create mode 100644 qemu-seccomp.c > create mode 100644 qemu-seccomp.h > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > new file mode 100644 > index 0000000..0442348 > --- /dev/null > +++ b/qemu-seccomp.c > @@ -0,0 +1,88 @@ > +/* > + * QEMU seccomp mode 2 support with libseccomp > + * > + * Copyright IBM, Corp. 2012 > + * > + * Authors: > + * Eduardo Otubo <eotubo@br.ibm.com> > + * > + * This work is licensed under the terms of the GNU GPL, version 2. See > + * the COPYING file in the top-level directory. > + * > + * Contributions after 2012-01-13 are licensed under the terms of the > + * GNU GPL, version 2 or (at your option) any later version. > + */ > +#include <stdio.h> > +#include <seccomp.h> > +#include "qemu-seccomp.h" > + > +struct QemuSeccompSyscall { > + int32_t num; > + uint8_t priority; > +}; > + > +const static struct QemuSeccompSyscall seccomp_whitelist[] = { > + { SCMP_SYS(timer_settime), 255 }, > + { SCMP_SYS(timer_gettime), 254 }, > + { SCMP_SYS(futex), 253 }, > + { SCMP_SYS(select), 252 }, > + { SCMP_SYS(recvfrom), 251 }, > + { SCMP_SYS(sendto), 250 }, > + { SCMP_SYS(read), 249 }, > + { SCMP_SYS(brk), 248 }, > + { SCMP_SYS(clone), 247 }, > + { SCMP_SYS(mmap), 247 }, > + { SCMP_SYS(mprotect), 246 }, > + { SCMP_SYS(execve), 245 }, > + { SCMP_SYS(open), 245 }, > + { SCMP_SYS(ioctl), 245 }, > + { SCMP_SYS(recvmsg), 245 }, > + { SCMP_SYS(sendmsg), 245 }, > + { SCMP_SYS(accept), 245 }, > + { SCMP_SYS(connect), 245 }, > + { SCMP_SYS(bind), 245 }, > + { SCMP_SYS(listen), 245 }, > + { SCMP_SYS(ioctl), 245 }, > + { SCMP_SYS(eventfd), 245 }, > + { SCMP_SYS(rt_sigprocmask), 245 }, > + { SCMP_SYS(write), 244 }, > + { SCMP_SYS(fcntl), 243 }, > + { SCMP_SYS(tgkill), 242 }, > + { SCMP_SYS(rt_sigaction), 242 }, > + { SCMP_SYS(pipe2), 242 }, > + { SCMP_SYS(munmap), 242 }, > + { SCMP_SYS(mremap), 242 }, > + { SCMP_SYS(getsockname), 242 }, > + { SCMP_SYS(getpeername), 242 }, > + { SCMP_SYS(fdatasync), 242 }, > + { SCMP_SYS(close), 242 } preadv, pwritev, io_submit, io_cancel, io_getevents Stefan ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c 2012-06-21 22:10 ` [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c Eduardo Otubo 2012-06-22 8:29 ` Stefan Hajnoczi @ 2012-06-24 6:08 ` Blue Swirl 1 sibling, 0 replies; 6+ messages in thread From: Blue Swirl @ 2012-06-24 6:08 UTC (permalink / raw) To: Eduardo Otubo; +Cc: qemu-devel On Thu, Jun 21, 2012 at 10:10 PM, Eduardo Otubo <otubo@linux.vnet.ibm.com> wrote: > I added a syscall struct using priority levels as described in the > libseccomp man page. The priority numbers are based to the frequency > they appear in a sample strace from a regular qemu guest run under > libvirt. > > Libseccomp generates linear BPF code to filter system calls, those rules > are read one after another. The priority system places the most common > rules first in order to reduce the overhead when processing them. > > v2: > * Fixed some style issues > * Removed code from vl.c and created qemu-seccomp.[ch] > * Now using ARRAY_SIZE macro > * Added more syscalls without priority/frequency set yet > > v3: > * Adding copyright and license information > * Replacing seccomp_whitelist_count just by ARRAY_SIZE > * Adding header protection to qemu-seccomp.h > * Moving QemuSeccompSyscall definition to qemu-seccomp.c > * Negative return from seccomp_start is fatal now. > * Adding open() and execve() to the whitelis > > The whitelist is getting bigger and complete, maybe it's time to drop > the RFC tag. > > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> > --- > qemu-seccomp.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > qemu-seccomp.h | 23 +++++++++++++++ > vl.c | 11 +++++++ > 3 files changed, 122 insertions(+) > create mode 100644 qemu-seccomp.c > create mode 100644 qemu-seccomp.h > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > new file mode 100644 > index 0000000..0442348 > --- /dev/null > +++ b/qemu-seccomp.c > @@ -0,0 +1,88 @@ > +/* > + * QEMU seccomp mode 2 support with libseccomp > + * > + * Copyright IBM, Corp. 2012 > + * > + * Authors: > + * Eduardo Otubo <eotubo@br.ibm.com> > + * > + * This work is licensed under the terms of the GNU GPL, version 2. See > + * the COPYING file in the top-level directory. > + * > + * Contributions after 2012-01-13 are licensed under the terms of the > + * GNU GPL, version 2 or (at your option) any later version. Can't you just license the files under GPLv2+ directly? > + */ > +#include <stdio.h> > +#include <seccomp.h> > +#include "qemu-seccomp.h" > + > +struct QemuSeccompSyscall { > + int32_t num; > + uint8_t priority; > +}; > + > +const static struct QemuSeccompSyscall seccomp_whitelist[] = { Usually the order is 'static const'. > + { SCMP_SYS(timer_settime), 255 }, > + { SCMP_SYS(timer_gettime), 254 }, > + { SCMP_SYS(futex), 253 }, > + { SCMP_SYS(select), 252 }, > + { SCMP_SYS(recvfrom), 251 }, > + { SCMP_SYS(sendto), 250 }, > + { SCMP_SYS(read), 249 }, > + { SCMP_SYS(brk), 248 }, > + { SCMP_SYS(clone), 247 }, > + { SCMP_SYS(mmap), 247 }, > + { SCMP_SYS(mprotect), 246 }, > + { SCMP_SYS(execve), 245 }, > + { SCMP_SYS(open), 245 }, > + { SCMP_SYS(ioctl), 245 }, > + { SCMP_SYS(recvmsg), 245 }, > + { SCMP_SYS(sendmsg), 245 }, > + { SCMP_SYS(accept), 245 }, > + { SCMP_SYS(connect), 245 }, > + { SCMP_SYS(bind), 245 }, > + { SCMP_SYS(listen), 245 }, > + { SCMP_SYS(ioctl), 245 }, > + { SCMP_SYS(eventfd), 245 }, > + { SCMP_SYS(rt_sigprocmask), 245 }, > + { SCMP_SYS(write), 244 }, > + { SCMP_SYS(fcntl), 243 }, > + { SCMP_SYS(tgkill), 242 }, > + { SCMP_SYS(rt_sigaction), 242 }, > + { SCMP_SYS(pipe2), 242 }, > + { SCMP_SYS(munmap), 242 }, > + { SCMP_SYS(mremap), 242 }, > + { SCMP_SYS(getsockname), 242 }, > + { SCMP_SYS(getpeername), 242 }, > + { SCMP_SYS(fdatasync), 242 }, > + { SCMP_SYS(close), 242 } > +}; > + > +int seccomp_start(void) > +{ > + int rc = 0; > + unsigned int i = 0; > + > + rc = seccomp_init(SCMP_ACT_KILL); > + if (rc < 0) { > + goto seccomp_return; > + } > + > + for (i = 0; i < ARRAY_SIZE(seccomp_whitelist); i++) { > + rc = seccomp_rule_add(SCMP_ACT_ALLOW, seccomp_whitelist[i].num, 0); > + if (rc < 0) { > + goto seccomp_return; > + } > + rc = seccomp_syscall_priority(seccomp_whitelist[i].num, > + seccomp_whitelist[i].priority); > + if (rc < 0) { > + goto seccomp_return; > + } > + } > + > + rc = seccomp_load(); > + > + seccomp_return: > + seccomp_release(); > + return rc; > +} > diff --git a/qemu-seccomp.h b/qemu-seccomp.h > new file mode 100644 > index 0000000..3253786 > --- /dev/null > +++ b/qemu-seccomp.h > @@ -0,0 +1,23 @@ > +/* > + * QEMU seccomp mode 2 support with libseccomp > + * > + * Copyright IBM, Corp. 2012 > + * > + * Authors: > + * Eduardo Otubo <eotubo@br.ibm.com> > + * > + * This work is licensed under the terms of the GNU GPL, version 2. See > + * the COPYING file in the top-level directory. > + * > + * Contributions after 2012-01-13 are licensed under the terms of the > + * GNU GPL, version 2 or (at your option) any later version. > + */ > +#ifndef CONFIG_LIBSECCOMP > +#define CONFIG_LIBSECCOMP > + > +#include <seccomp.h> > +#include "osdep.h" > + > +int seccomp_start(void); > + > +#endif > diff --git a/vl.c b/vl.c > index 1329c30..83526f1 100644 > --- a/vl.c > +++ b/vl.c > @@ -62,6 +62,9 @@ > #include <linux/ppdev.h> > #include <linux/parport.h> > #endif > +#ifdef CONFIG_LIBSECCOMP > +#include "qemu-seccomp.h" > +#endif > #ifdef __sun__ > #include <sys/stat.h> > #include <sys/ethernet.h> > @@ -2296,6 +2299,14 @@ int main(int argc, char **argv, char **envp) > const char *trace_events = NULL; > const char *trace_file = NULL; > > +#ifdef CONFIG_LIBSECCOMP > + if (seccomp_start() < 0) { > + fprintf(stderr, > + "failed to configure the seccomp syscall filter in the kernel\n"); > + exit(1); > + } > +#endif > + > atexit(qemu_run_exit_notifiers); > error_set_progname(argv[0]); > > -- > 1.7.9.5 > > ^ permalink raw reply [flat|nested] 6+ messages in thread
* Re: [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp 2012-06-21 22:10 [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo 2012-06-21 22:10 ` [Qemu-devel] [PATCH 1/2] Adding support for libseccomp in configure and Makefile Eduardo Otubo 2012-06-21 22:10 ` [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c Eduardo Otubo @ 2012-06-22 12:17 ` Eduardo Otubo 2 siblings, 0 replies; 6+ messages in thread From: Eduardo Otubo @ 2012-06-22 12:17 UTC (permalink / raw) To: qemu-devel My apologies, I forgot to add the v3 into the PATCH tag. On Thu, Jun 21, 2012 at 07:10:36PM -0300, Eduardo Otubo wrote: > Hello all, > > This is the third effort to sandbox Qemu guests using Libseccomp[0]. The > patches that follows are pretty simple and straightforward. I added the correct > options and checks to the configure script and the basic calls to libseccomp in > the main loop at vl.c. Details of each one are in the emails of the patch set. > > v2: The code now is separated in the files qemu-seccomp.c and qemu-seccomp.h > for a cleaner implementation. > > This support limits the system call footprint of the entire QEMU process to a > limited set of syscalls, those that we know QEMU uses. The idea is to limit > the allowable syscalls, therefore limiting the impact that an attacked guest > could have on the host system. > > It's important to note that the libseccomp itself needs the seccomp mode 2 > feature in the kernel, which is pretty close to get to the mainline since it's > already been accepted to the linux-next branch[1]. > > v2: I also tested with the 3.5-rc1 kernel, which is the one with seccomp mode 2 > support. Everything went fine. > > v3: As we discussed in previous emails in this very mailing list, this feature > is not supposed to replace existing security feature, but add another layer to > the whole. The whitelist should contain all the syscalls QEMU needs, so its > execution won't be affected, just safer. And as stated by Will Drewry's commit > message[1]: "Filter programs will be inherited across fork/clone and execve.", > the same white list should be passed along from the father process to the > child, then execve() shouldn't be a problem. > > As always, comments are more than welcome. > > Regards, > > [0] - Now you don't need to git clone anymore, you can download the first > release - http://sourceforge.net/projects/libseccomp/ > [1] - http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=commit;h=e2cfabdfd075648216f99c2c03821cf3f47c1727 > > > Eduardo Otubo (2): > Adding support for libseccomp in configure and Makefile > Creating qemu-seccomp.[ch] and adding call to vl.c > > Makefile.objs | 4 +++ > configure | 23 +++++++++++++++ > qemu-seccomp.c | 88 ++++++++++++++++++++++++++++++++++++++++++++++++++++++++ > qemu-seccomp.h | 23 +++++++++++++++ > vl.c | 11 +++++++ > 5 files changed, 149 insertions(+) > create mode 100644 qemu-seccomp.c > create mode 100644 qemu-seccomp.h > > -- > 1.7.9.5 > -- Eduardo Otubo Software Engineer Linux Technology Center IBM Systems & Technology Group Mobile: +55 19 8135 0885 eotubo@linux.vnet.ibm.com ^ permalink raw reply [flat|nested] 6+ messages in thread
end of thread, other threads:[~2012-06-24 6:08 UTC | newest] Thread overview: 6+ messages (download: mbox.gz follow: Atom feed -- links below jump to the message on this page -- 2012-06-21 22:10 [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo 2012-06-21 22:10 ` [Qemu-devel] [PATCH 1/2] Adding support for libseccomp in configure and Makefile Eduardo Otubo 2012-06-21 22:10 ` [Qemu-devel] [PATCH 2/2] Creating qemu-seccomp.[ch] and adding call to vl.c Eduardo Otubo 2012-06-22 8:29 ` Stefan Hajnoczi 2012-06-24 6:08 ` Blue Swirl 2012-06-22 12:17 ` [Qemu-devel] [PATCH 0/2] Sandboxing Qemu guests with Libseccomp Eduardo Otubo
This is a public inbox, see mirroring instructions for how to clone and mirror all data and code used for this inbox; as well as URLs for NNTP newsgroup(s).