[Qemu-devel] [PATCH 0/2] QEMU/seccomp fixes for PulseAudio

[Qemu-devel] [PATCH 0/2] QEMU/seccomp fixes for PulseAudio

[Paul Moore]

It turns out we need to add some additional syscalls to QEMU to make
PulseAudio happy.  Two minor patches follow ...

---

Paul Moore (2):
      seccomp: add mkdir() and fchmod() to the whitelist
      seccomp: add some basic shared memory syscalls to the whitelist


 qemu-seccomp.c |    7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

[Qemu-devel] [PATCH 1/2] seccomp: add mkdir() and fchmod() to the whitelist

[Paul Moore]

The PulseAudio library attempts to do a mkdir(2) and fchmod(2) on
"/run/user/<UID>/pulse" which is currently blocked by the syscall
filter; this patch adds the two missing syscalls to the whitelist.
You can reproduce this problem with the following command:

 # qemu -monitor stdio -device intel-hda -device hda-duplex

If watched under strace the following syscalls are shown:

 mkdir("/run/user/0/pulse", 0700)
 fchmod(11, 0700) [NOTE: 11 is the fd for /run/user/0/pulse]

Reported-by: xuhan@redhat.com
Signed-off-by: Paul Moore <pmoore@redhat.com>
---
 qemu-seccomp.c |    4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index b7c1253..89f244f 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -220,7 +220,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(io_cancel), 241 },
     { SCMP_SYS(io_setup), 241 },
     { SCMP_SYS(io_destroy), 241 },
-    { SCMP_SYS(arch_prctl), 240 }
+    { SCMP_SYS(arch_prctl), 240 },
+    { SCMP_SYS(mkdir), 240 },
+    { SCMP_SYS(fchmod), 240 }
 };
 
 int seccomp_start(void)

[Qemu-devel] [PATCH 2/2] seccomp: add some basic shared memory syscalls to the whitelist

[Paul Moore]

PulseAudio requires the use of shared memory so add shmget(), shmat(),
and shmdt() to the syscall whitelist.

Reported-by: xuhan@redhat.com
Signed-off-by: Paul Moore <pmoore@redhat.com>
---
 qemu-seccomp.c |    5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 89f244f..caa926e 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -222,7 +222,10 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(io_destroy), 241 },
     { SCMP_SYS(arch_prctl), 240 },
     { SCMP_SYS(mkdir), 240 },
-    { SCMP_SYS(fchmod), 240 }
+    { SCMP_SYS(fchmod), 240 },
+    { SCMP_SYS(shmget), 240 },
+    { SCMP_SYS(shmat), 240 },
+    { SCMP_SYS(shmdt), 240 }
 };
 
 int seccomp_start(void)

Re: [Qemu-devel] [PATCH 0/2] QEMU/seccomp fixes for PulseAudio

[Eduardo Otubo]

On 01/15/2014 05:38 PM, Paul Moore wrote:
> It turns out we need to add some additional syscalls to QEMU to make
> PulseAudio happy.  Two minor patches follow ...
>
> ---
>
> Paul Moore (2):
>        seccomp: add mkdir() and fchmod() to the whitelist
>        seccomp: add some basic shared memory syscalls to the whitelist
>
>
>   qemu-seccomp.c |    7 ++++++-
>   1 file changed, 6 insertions(+), 1 deletion(-)
>
>

Paul, sorry for the so late review. I was on vacation until yesterday 
and I'm still trying to empty my inbox.

-- 
Eduardo Otubo
IBM Linux Technology Center

Re: [Qemu-devel] [PATCH 1/2] seccomp: add mkdir() and fchmod() to the whitelist

[Eduardo Otubo]

I have tested and reviewed both patches. And if nothing more comes up, 
I'll send a pull request by tomorrow EOD.

On 01/15/2014 05:38 PM, Paul Moore wrote:
> The PulseAudio library attempts to do a mkdir(2) and fchmod(2) on
> "/run/user/<UID>/pulse" which is currently blocked by the syscall
> filter; this patch adds the two missing syscalls to the whitelist.
> You can reproduce this problem with the following command:
>
>   # qemu -monitor stdio -device intel-hda -device hda-duplex
>
> If watched under strace the following syscalls are shown:
>
>   mkdir("/run/user/0/pulse", 0700)
>   fchmod(11, 0700) [NOTE: 11 is the fd for /run/user/0/pulse]
>
> Reported-by: xuhan@redhat.com
> Signed-off-by: Paul Moore <pmoore@redhat.com>
> ---
>   qemu-seccomp.c |    4 +++-
>   1 file changed, 3 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index b7c1253..89f244f 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -220,7 +220,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>       { SCMP_SYS(io_cancel), 241 },
>       { SCMP_SYS(io_setup), 241 },
>       { SCMP_SYS(io_destroy), 241 },
> -    { SCMP_SYS(arch_prctl), 240 }
> +    { SCMP_SYS(arch_prctl), 240 },
> +    { SCMP_SYS(mkdir), 240 },
> +    { SCMP_SYS(fchmod), 240 }

ACK.

-- 
Eduardo Otubo
IBM Linux Technology Center

Re: [Qemu-devel] [PATCH 2/2] seccomp: add some basic shared memory syscalls to the whitelist

[Eduardo Otubo]

On 01/15/2014 05:38 PM, Paul Moore wrote:
> PulseAudio requires the use of shared memory so add shmget(), shmat(),
> and shmdt() to the syscall whitelist.
>
> Reported-by: xuhan@redhat.com
> Signed-off-by: Paul Moore <pmoore@redhat.com>
> ---
>   qemu-seccomp.c |    5 ++++-
>   1 file changed, 4 insertions(+), 1 deletion(-)
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 89f244f..caa926e 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -222,7 +222,10 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>       { SCMP_SYS(io_destroy), 241 },
>       { SCMP_SYS(arch_prctl), 240 },
>       { SCMP_SYS(mkdir), 240 },
> -    { SCMP_SYS(fchmod), 240 }
> +    { SCMP_SYS(fchmod), 240 },
> +    { SCMP_SYS(shmget), 240 },
> +    { SCMP_SYS(shmat), 240 },
> +    { SCMP_SYS(shmdt), 240 }

ACK.

-- 
Eduardo Otubo
IBM Linux Technology Center

Re: [Qemu-devel] [PATCH 0/2] QEMU/seccomp fixes for PulseAudio

[Paul Moore]

On Thursday, January 16, 2014 01:52:30 PM Eduardo Otubo wrote:
> On 01/15/2014 05:38 PM, Paul Moore wrote:
> > It turns out we need to add some additional syscalls to QEMU to make
> > PulseAudio happy.  Two minor patches follow ...
> > 
> > ---
> > 
> > Paul Moore (2):
> >        seccomp: add mkdir() and fchmod() to the whitelist
> >        seccomp: add some basic shared memory syscalls to the whitelist
> >   
> >   qemu-seccomp.c |    7 ++++++-
> >   1 file changed, 6 insertions(+), 1 deletion(-)
> 
> Paul, sorry for the so late review. I was on vacation until yesterday
> and I'm still trying to empty my inbox.

No worries.  Personally, I wouldn't call a one day turnaround as a late 
review, I'd call that pretty good :)

-- 
paul moore
security and virtualization @ redhat