Re: [Qemu-devel] [PATCHv2 1/4] Adding new syscalls (bugzilla 855162)

[Eduardo Otubo <otubo@linux.vnet.ibm.com>]

On Thu, Nov 01, 2012 at 05:43:03PM -0400, Paul Moore wrote:
> On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote:
> > According to the bug 855162[0] - there's the need of adding new syscalls
> > to the whitelist whenn using Qemu with Libvirt.
> > 
> > [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162
> > 
> > v2: Adding new syscalls to the list: readlink, rt_sigpending, and
> >     rt_sigtimedwait
> > 
> > Reported-by: Paul Moore <pmoore@redhat.com>
> > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> > ---
> >  qemu-seccomp.c | 13 ++++++++++++-
> >  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> I had an opportunity to test this patchset on a F17 machine using QEMU 1.2 and 
> unfortunately it still fails.  I'm using a relatively basic guest 
> configuration running F16, the details are documented in the RH BZ that 
> Eduardo mentioned in the patch description.
> 
> Eduardo, I assume you are not able to reproduce this?

Unfortunately no. But we have the v3  patchset coming soon with new
syscalls and we're hoping to get this fixed. Thanks for the feedback
Paul!

> 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 64329a3..a7b33e2 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -45,6 +45,13 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = { { SCMP_SYS(access), 245 },
> >      { SCMP_SYS(prctl), 245 },
> >      { SCMP_SYS(signalfd), 245 },
> > +    { SCMP_SYS(getrlimit), 245 },
> > +    { SCMP_SYS(set_tid_address), 245 },
> > +    { SCMP_SYS(socketpair), 245 },
> > +    { SCMP_SYS(statfs), 245 },
> > +    { SCMP_SYS(unlink), 245 },
> > +    { SCMP_SYS(wait4), 245 },
> > +    { SCMP_SYS(getuid), 245 },
> >  #if defined(__i386__)
> >      { SCMP_SYS(fcntl64), 245 },
> >      { SCMP_SYS(fstat64), 245 },
> > @@ -107,7 +114,11 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 },
> >      { SCMP_SYS(getpeername), 242 },
> >      { SCMP_SYS(fdatasync), 242 },
> > -    { SCMP_SYS(close), 242 }
> > +    { SCMP_SYS(close), 242 },
> > +    { SCMP_SYS(accept4), 242 },
> > +    { SCMP_SYS(readlink), 242 },
> > +    { SCMP_SYS(rt_sigpending), 242 },
> > +    { SCMP_SYS(rt_sigtimedwait), 242 }
> >  };
> > 
> >  int seccomp_start(void)
> -- 
> paul moore
> security and virtualization @ redhat
> 

-- 
Eduardo Otubo
Software Engineer
Linux Technology Center
IBM Systems & Technology Group