From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:35713) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1StIEd-0004Zm-3f for qemu-devel@nongnu.org; Mon, 23 Jul 2012 08:59:40 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1StIEY-00049I-Gu for qemu-devel@nongnu.org; Mon, 23 Jul 2012 08:59:39 -0400 Received: from e24smtp04.br.ibm.com ([32.104.18.25]:35481) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1StIEX-00048o-PH for qemu-devel@nongnu.org; Mon, 23 Jul 2012 08:59:34 -0400 Received: from /spool/local by e24smtp04.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 23 Jul 2012 09:59:28 -0300 Received: from d24relay03.br.ibm.com (d24relay03.br.ibm.com [9.13.184.25]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 4A015352004C for ; Mon, 23 Jul 2012 08:59:23 -0400 (EDT) Received: from d24av02.br.ibm.com (d24av02.br.ibm.com [9.8.31.93]) by d24relay03.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q6NCwdDY28508224 for ; Mon, 23 Jul 2012 09:58:39 -0300 Received: from d24av02.br.ibm.com (loopback [127.0.0.1]) by d24av02.br.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q6NCxOqT028006 for ; Mon, 23 Jul 2012 09:59:25 -0300 Date: Mon, 23 Jul 2012 09:59:18 -0300 From: Eduardo Otubo Message-ID: <20120723125917.GA13836@bluepex.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [PATCHv4 0/4] Sandboxing Qemu guests with Libseccomp List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: qemu-devel@nongnu.org Cc: blauwirbel@gmail.com, pmoore@redhat.com, wad@chromium.org, anthony@codemonkey.ws On Tue, Jul 17, 2012 at 04:19:11PM -0300, Eduardo Otubo wrote: > Hello all, > > This patch is an effort to sandbox Qemu guests using Libseccomp[0]. The patches > that follows are pretty simple and straightforward. I added the correct options > and checks to the configure script and the basic calls to libseccomp in the > main loop at vl.c. Details of each one are in the emails of the patch set. > > This support limits the system call footprint of the entire QEMU process to a > limited set of syscalls, those that we know QEMU uses. The idea is to limit the > allowable syscalls, therefore limiting the impact that an attacked guest could > have on the host system. > > It's important to note that the libseccomp itself needs the seccomp mode 2 > feature in the kernel, which is only available in kernel versions older (or > equal) than 3.5-rc1. > > v2: Files separated in qemu-seccomp.c and qemu-seccomp.h for a cleaner > implementation. The development was tested with the 3.5-rc1 kernel. > > v3: As we discussed in previous emails in this mailing list, this feature is > not supposed to replace existing security feature, but add another layer to > the whole. The whitelist should contain all the syscalls QEMU needs. And as > stated by Will Drewry's commit message[1]: "Filter programs will be inherited > across fork/clone and execve.", the same white list should be passed along from > the father process to the child, then execve() shouldn't be a problem. Note > that there's a feature PR_SET_NO_NEW_PRIVS in seccomp mode 2 in the kernel, > this prevents processes from gaining privileges on execve. For example, this > will prevent qemu (if running unprivileged) from executing setuid programs[2]. > > v4: Introducing "debug" mode on libseccomp support. The "debug" mode will set > the flag SCMP_ACT_TRAP when calling seccomp_start(). It will verbosely > print a message to the stderr in the form "seccomp: illegal system call > execution trapped: XXX" and resume the execution. This is really just used as > debug mode, it helps users and developers to full fill the whitelist. > > As always, comments are more than welcome. Hello folks, Does anyone got a chance to take a look at these? Thanks in advance :) > > Regards, > > [0] - http://sourceforge.net/projects/libseccomp/ > [1] - http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=commit;h=e2cfabdfd075648216f99c2c03821cf3f47c1727 > [2] - https://lkml.org/lkml/2012/4/12/457 > > Eduardo Otubo (4): > Adding support for libseccomp in configure and Makefile > Adding qemu-seccomp.[ch] > Adding qemu-seccomp-debug.[ch] > Adding seccomp calls to vl.c > > Makefile.objs | 10 ++++ > configure | 34 ++++++++++++++ > qemu-seccomp-debug.c | 95 +++++++++++++++++++++++++++++++++++++ > qemu-seccomp-debug.h | 38 +++++++++++++++ > qemu-seccomp.c | 126 ++++++++++++++++++++++++++++++++++++++++++++++++++ > qemu-seccomp.h | 22 +++++++++ > vl.c | 31 +++++++++++++ > 7 files changed, 356 insertions(+) > create mode 100644 qemu-seccomp-debug.c > create mode 100644 qemu-seccomp-debug.h > create mode 100644 qemu-seccomp.c > create mode 100644 qemu-seccomp.h > > -- > 1.7.9.5 > -- Eduardo Otubo Software Engineer Linux Technology Center IBM Systems & Technology Group Mobile: +55 19 8135 0885 eotubo@linux.vnet.ibm.com