Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist

[Paul Moore <pmoore@redhat.com>]

On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote:
> Now there's a second whitelist, right before the vcpu starts. The second
> whitelist is the same as the first one, except for exec() and select().
> 
> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>

We talked about this in a previous thread, but as a reminder, the kernel's 
seccomp BPF filter works by executing all of the loaded filters for each 
syscall and taking the least permissive action for all of the results.  In 
other words, if one filter returns ALLOW for a given syscall and another 
filter returns KILL, the kernel will select the KILL action for the syscall.

With that in mind, I think the best option is to keep the existing whitelist 
and instead of creating a second whitelist, create a second *blacklist* that 
removes the syscalls you don't want to allow anymore, e.g. exec() and 
select().  This approach should be easier to maintain and would result in less 
overhead in the kernel's seccomp evaluator (the blacklist filter would be much 
smaller than a second whitelist filter).

-Paul

-- 
paul moore
security and virtualization @ redhat