From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37412) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zi2Nf-0005Z2-SN for qemu-devel@nongnu.org; Fri, 02 Oct 2015 11:36:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Zi2Nb-00086u-Pi for qemu-devel@nongnu.org; Fri, 02 Oct 2015 11:36:19 -0400 Received: from mail-wi0-f173.google.com ([209.85.212.173]:37800) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Zi2Nb-00086U-Je for qemu-devel@nongnu.org; Fri, 02 Oct 2015 11:36:15 -0400 Received: by wicfx3 with SMTP id fx3so36205191wic.0 for ; Fri, 02 Oct 2015 08:36:15 -0700 (PDT) Date: Fri, 2 Oct 2015 17:36:12 +0200 From: Eduardo Otubo Message-ID: <20151002153612.GD25464@vader> References: <87r3leztbr.fsf@blackfin.pond.sub.org> <20151002083047.GA28469@redhat.com> <87twq9bn5l.fsf@blackfin.pond.sub.org> <20151002140820.GB25464@vader> <20151002141505.GF28469@redhat.com> MIME-Version: 1.0 Content-Type: multipart/signed; micalg=pgp-sha1; protocol="application/pgp-signature"; boundary="mJm6k4Vb/yFcL9ZU" Content-Disposition: inline In-Reply-To: <20151002141505.GF28469@redhat.com> Subject: Re: [Qemu-devel] [PATCH] Add syscalls for -runas and -chroot to the seccomp sandbox List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: Namsun Ch'o , Markus Armbruster , qemu-devel@nongnu.org --mJm6k4Vb/yFcL9ZU Content-Type: text/plain; charset=us-ascii Content-Disposition: inline Content-Transfer-Encoding: quoted-printable On Fri, Oct 02, 2015 at 03=3D15=3D05PM +0100, Daniel P. Berrange wrote: > On Fri, Oct 02, 2015 at 04:08:20PM +0200, Eduardo Otubo wrote: > > On Fri, Oct 02, 2015 at 12=3D05=3D58PM +0200, Markus Armbruster wrote: > > > "Daniel P. Berrange" writes: > > >=20 > > > > On Thu, Oct 01, 2015 at 02:06:32PM +0200, Markus Armbruster wrote: > > > >> "Namsun Ch'o" writes: > > > >>=20 > > > >> > The seccomp sandbox doesn't whitelist setuid, setgid, or > > > >> > setgroups, which are > > > >> > needed for -runas to work. It also doesn't whitelist chroot, whi= ch is needed > > > >> > for the -chroot option. Unfortunately, QEMU enables seccomp befo= re it drops > > > >> > privileges or chroots, so without these whitelisted, -runas and > > > >> > -chroot cause > > > >> > QEMU to be killed with -sandbox on. This patch adds those syscal= ls. > > > >>=20 > > > >> Should it enable seccomp a bit later? > > > > > > > > Yeah, I think it would be better to move the seccomp enablement lat= er. > > >=20 > > > Let's do that then. > >=20 > > Where exactly you guys think we could call seccomp enablement? Right > > it's called (almost) right before cpu_exec_init_all(), on vl.c:4013. I > > guess it is as later as it could. >=20 > It depends on what you consider seccomp to be protecting against. I think > its primary goal is to protect against exploit after a guest OS breakout, > in which case it does not need to be enabled until the guest CPUs start > executing, which IIUC, means immediately before main_loop(). >=20 > If we intend seccomp to protect against flaws during QEMU setup, then hav= ing > it earlier is neccessary. eg QEMU opening a corrupt qcow2 image which mig= ht > exploit QEMU before the guest CPUs start. >=20 > If the latter is the case, then we could start with a relaxed seccomp > sandbox which included the setuid/chroot features, and then switch to a > more restricted one which blocked them before main_loop() runs. Our intention since the beginning was to protect the host from the illegal guest operations. But you do have an interesting point about flaws on qemu itself. Perhaps this might be something I could work on to improve (start a bigger whitelist and get it tighter before guest launches). --=20 Eduardo Otubo ProfitBricks GmbH --mJm6k4Vb/yFcL9ZU Content-Type: application/pgp-signature; name="signature.asc" Content-Description: Digital signature -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iQEcBAEBAgAGBQJWDqRsAAoJEP0M/1sS+L0vTpAH/AgGxfUZZjV5NbbdhHZsUfUX 5LbBqX1FJnpJO3GPXvpldRZjW60HojuaWyaiWTk9iTmsgVEcXyvxEP6RBksnsgoN ZymUvc/YZIS/0/hbgHX4r5quTDX+17SzFI0TRubbXGRaEsfVDdlqQPdqLon+WvDb w4mmNWlISUjSofcrp6a6LTb5AyzkJDmBT1UWrNYlxPN5+Royg4SzDEygUWnPIaFI uoY4tWlWMV+4XTW7rvztciWhPDAbhcFsbZ0Ddh8Qs6av8RdzWQC+KhbpB4Poa/B3 FycQJ+iOrDGTiwZScf4xaQVoykgmk0s+G9ibbYHftBI29DijY3rSz2cuhHH9PBU= =uxjI -----END PGP SIGNATURE----- --mJm6k4Vb/yFcL9ZU--