From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org X-Spam-Level: X-Spam-Status: No, score=-16.0 required=3.0 tests=BAYES_00,DKIM_INVALID, DKIM_SIGNED,HEADER_FROM_DIFFERENT_DOMAINS,INCLUDES_PATCH,MAILING_LIST_MULTI, MENTIONS_GIT_HOSTING,SIGNED_OFF_BY,SPF_HELO_NONE,SPF_PASS,URIBL_BLOCKED, USER_AGENT_SANE_1 autolearn=ham autolearn_force=no version=3.4.0 Received: from mail.kernel.org (mail.kernel.org [198.145.29.99]) by smtp.lore.kernel.org (Postfix) with ESMTP id B0ABFC388F2 for ; Mon, 2 Nov 2020 15:22:37 +0000 (UTC) Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mail.kernel.org (Postfix) with ESMTPS id 15A5E22226 for ; Mon, 2 Nov 2020 15:22:37 +0000 (UTC) Authentication-Results: mail.kernel.org; dkim=fail reason="signature verification failed" (1024-bit key) header.d=redhat.com header.i=@redhat.com header.b="TeAcRGPx" DMARC-Filter: OpenDMARC Filter v1.3.2 mail.kernel.org 15A5E22226 Authentication-Results: mail.kernel.org; dmarc=fail (p=none dis=none) header.from=redhat.com Authentication-Results: mail.kernel.org; spf=pass smtp.mailfrom=qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Received: from localhost ([::1]:39662 helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1kZbfH-0000SN-8R for qemu-devel@archiver.kernel.org; Mon, 02 Nov 2020 10:22:35 -0500 Received: from eggs.gnu.org ([2001:470:142:3::10]:51490) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1kZbbe-0005uD-Jm for qemu-devel@nongnu.org; Mon, 02 Nov 2020 10:18:50 -0500 Received: from us-smtp-delivery-124.mimecast.com ([216.205.24.124]:47108) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_CBC_SHA1:256) (Exim 4.90_1) (envelope-from ) id 1kZbbb-0007CZ-IZ for qemu-devel@nongnu.org; Mon, 02 Nov 2020 10:18:49 -0500 DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=redhat.com; s=mimecast20190719; t=1604330324; h=from:from:reply-to:reply-to:subject:subject:date:date: message-id:message-id:to:to:cc:cc:mime-version:mime-version: content-type:content-type: content-transfer-encoding:content-transfer-encoding: in-reply-to:in-reply-to:references:references; bh=TNKrEi3TT2Xqr2SxkQF0QH9j45yrE6ijkLgLtigrA2g=; b=TeAcRGPxzKppsVNwSXnRLHWYIpnxh7to0/rQSH/jnDRjfnafOek3Li0KvKG+HkZtaGnLsX qihVAOokR1CCrN+cTNbLrLa6ckGgN3Z8zdbjansIGY+1F9WkrnkrlpTQqDFaD6ox3qVpPf rgNiGjInf3hygmuaOcAPy1/wZhla32A= Received: from mimecast-mx01.redhat.com (mimecast-mx01.redhat.com [209.132.183.4]) (Using TLS) by relay.mimecast.com with ESMTP id us-mta-319-E2cmJqfZNNeoVWCaIcJXGg-1; Mon, 02 Nov 2020 10:18:42 -0500 X-MC-Unique: E2cmJqfZNNeoVWCaIcJXGg-1 Received: from smtp.corp.redhat.com (int-mx05.intmail.prod.int.phx2.redhat.com [10.5.11.15]) (using TLSv1.2 with cipher AECDH-AES256-SHA (256/256 bits)) (No client certificate requested) by mimecast-mx01.redhat.com (Postfix) with ESMTPS id C069B10866A7; Mon, 2 Nov 2020 15:18:41 +0000 (UTC) Received: from redhat.com (ovpn-114-136.ams2.redhat.com [10.36.114.136]) by smtp.corp.redhat.com (Postfix) with ESMTPS id 258C175131; Mon, 2 Nov 2020 15:18:27 +0000 (UTC) Date: Mon, 2 Nov 2020 15:18:24 +0000 From: Daniel =?utf-8?B?UC4gQmVycmFuZ8Op?= To: Philippe =?utf-8?Q?Mathieu-Daud=C3=A9?= Subject: Re: [PATCH] virtiofsd: Seccomp: Add 'send' for syslog Message-ID: <20201102151824.GG138796@redhat.com> References: <20201102150750.34565-1-dgilbert@redhat.com> MIME-Version: 1.0 In-Reply-To: User-Agent: Mutt/1.14.6 (2020-07-11) X-Scanned-By: MIMEDefang 2.79 on 10.5.11.15 Authentication-Results: relay.mimecast.com; auth=pass smtp.auth=CUSA124A263 smtp.mailfrom=berrange@redhat.com X-Mimecast-Spam-Score: 0 X-Mimecast-Originator: redhat.com Content-Type: text/plain; charset=utf-8 Content-Disposition: inline Content-Transfer-Encoding: 8bit Received-SPF: pass client-ip=216.205.24.124; envelope-from=berrange@redhat.com; helo=us-smtp-delivery-124.mimecast.com X-detected-operating-system: by eggs.gnu.org: First seen = 2020/11/02 01:33:03 X-ACL-Warn: Detected OS = Linux 2.2.x-3.x [generic] [fuzzy] X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIMWL_WL_HIGH=-0.001, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H4=0.001, RCVD_IN_MSPIKE_WL=0.001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.23 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Reply-To: Daniel =?utf-8?B?UC4gQmVycmFuZ8Op?= Cc: virtio-fs@redhat.com, stefanha@redhat.com, "Dr. David Alan Gilbert \(git\)" , amulmek1@in.ibm.com, qemu-devel@nongnu.org Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: "Qemu-devel" On Mon, Nov 02, 2020 at 04:11:44PM +0100, Philippe Mathieu-Daudé wrote: > On 11/2/20 4:07 PM, Dr. David Alan Gilbert (git) wrote: > > From: "Dr. David Alan Gilbert" > > > > On ppc it looks like syslog ends up using 'send' rather than 'sendto'. > > > > Reference: https://github.com/kata-containers/kata-containers/issues/1050 > > > > Reported-by: amulmek1@in.ibm.com > > Signed-off-by: Dr. David Alan Gilbert > > --- > > tools/virtiofsd/passthrough_seccomp.c | 1 + > > 1 file changed, 1 insertion(+) > > > > diff --git a/tools/virtiofsd/passthrough_seccomp.c b/tools/virtiofsd/passthrough_seccomp.c > > index eb9af8265f..672fb72a31 100644 > > --- a/tools/virtiofsd/passthrough_seccomp.c > > +++ b/tools/virtiofsd/passthrough_seccomp.c > > @@ -118,6 +118,7 @@ static const int syscall_whitelist[] = { > > > > /* Syscalls used when --syslog is enabled */ > > static const int syscall_whitelist_syslog[] = { > > Is it worth restricting the syscall to POWER? That would be wrong, as this is needed on multiple arches. There is no real security benefit to restricting it either, as both syscalls give you broadly equivalent abilities. > > #if defined(__powerpc64__) > > > + SCMP_SYS(send), > > #endif > > > SCMP_SYS(sendto), > > }; Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|