From mboxrd@z Thu Jan  1 00:00:00 1970
Received: from eggs.gnu.org ([2001:4830:134:3::10]:51254)
	by lists.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1Zhvk0-0002yz-HX
	for qemu-devel@nongnu.org; Fri, 02 Oct 2015 04:30:57 -0400
Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1Zhvjx-0000J6-5v
	for qemu-devel@nongnu.org; Fri, 02 Oct 2015 04:30:56 -0400
Received: from mx1.redhat.com ([209.132.183.28]:43162)
	by eggs.gnu.org with esmtp (Exim 4.71)
	(envelope-from <berrange@redhat.com>) id 1Zhvjx-0000J1-0t
	for qemu-devel@nongnu.org; Fri, 02 Oct 2015 04:30:53 -0400
Date: Fri, 2 Oct 2015 09:30:47 +0100
From: "Daniel P. Berrange" <berrange@redhat.com>
Message-ID: <20151002083047.GA28469@redhat.com>
References: <N1-fOl1digGhI@Safe-mail.net>
	<87r3leztbr.fsf@blackfin.pond.sub.org>
MIME-Version: 1.0
Content-Type: text/plain; charset=utf-8
Content-Disposition: inline
In-Reply-To: <87r3leztbr.fsf@blackfin.pond.sub.org>
Subject: Re: [Qemu-devel] [PATCH] Add syscalls for -runas and -chroot to the
 seccomp sandbox
Reply-To: "Daniel P. Berrange" <berrange@redhat.com>
List-Id: <qemu-devel.nongnu.org>
List-Unsubscribe: <https://lists.nongnu.org/mailman/options/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=unsubscribe>
List-Archive: <http://lists.nongnu.org/archive/html/qemu-devel>
List-Post: <mailto:qemu-devel@nongnu.org>
List-Help: <mailto:qemu-devel-request@nongnu.org?subject=help>
List-Subscribe: <https://lists.nongnu.org/mailman/listinfo/qemu-devel>,
	<mailto:qemu-devel-request@nongnu.org?subject=subscribe>
To: Markus Armbruster <armbru@redhat.com>
Cc: Namsun Ch'o <namnamc@Safe-mail.net>, qemu-devel@nongnu.org, eduardo.otubo@profitbricks.com

On Thu, Oct 01, 2015 at 02:06:32PM +0200, Markus Armbruster wrote:
> "Namsun Ch'o" <namnamc@Safe-mail.net> writes:
> 
> > The seccomp sandbox doesn't whitelist setuid, setgid, or setgroups, which are
> > needed for -runas to work. It also doesn't whitelist chroot, which is needed
> > for the -chroot option. Unfortunately, QEMU enables seccomp before it drops
> > privileges or chroots, so without these whitelisted, -runas and -chroot cause
> > QEMU to be killed with -sandbox on. This patch adds those syscalls.
> 
> Should it enable seccomp a bit later?

Yeah, I think it would be better to move the seccomp enablement later.
Adding setuid and chroot to the allow list is pretty strongly undesirable
from a security protection POV.

Regards,
Daniel
-- 
|: http://berrange.com      -o-    http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org              -o-             http://virt-manager.org :|
|: http://autobuild.org       -o-         http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org       -o-       http://live.gnome.org/gtk-vnc :|