From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:38774) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TQgLw-0005H4-L4 for qemu-devel@nongnu.org; Tue, 23 Oct 2012 11:25:17 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1TQgLn-0003cS-RP for qemu-devel@nongnu.org; Tue, 23 Oct 2012 11:25:12 -0400 Received: from e33.co.us.ibm.com ([32.97.110.151]:38725) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1TQgLn-0003Np-Je for qemu-devel@nongnu.org; Tue, 23 Oct 2012 11:25:03 -0400 Received: from /spool/local by e33.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 23 Oct 2012 09:24:37 -0600 Received: from d03relay02.boulder.ibm.com (d03relay02.boulder.ibm.com [9.17.195.227]) by d03dlp01.boulder.ibm.com (Postfix) with ESMTP id 253631FF003C for ; Tue, 23 Oct 2012 09:23:26 -0600 (MDT) Received: from d03av01.boulder.ibm.com (d03av01.boulder.ibm.com [9.17.195.167]) by d03relay02.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q9NFFm5p074898 for ; Tue, 23 Oct 2012 09:23:23 -0600 Received: from d03av01.boulder.ibm.com (loopback [127.0.0.1]) by d03av01.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q9NFB4VJ010012 for ; Tue, 23 Oct 2012 09:11:04 -0600 Message-ID: <5086B382.8090405@linux.vnet.ibm.com> Date: Tue, 23 Oct 2012 11:10:58 -0400 From: Corey Bryant MIME-Version: 1.0 References: <1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com> <1350971732-16621-3-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: <1350971732-16621-3-git-send-email-otubo@linux.vnet.ibm.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCHv2 3/4] Support for "double whitelist" filters List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo Cc: pmoore@redhat.com, aliguori@us.ibm.com, qemu-devel@nongnu.org On 10/23/2012 01:55 AM, Eduardo Otubo wrote: > This patch includes a second whitelist right before the main loop. It's > a smaller and more restricted whitelist, excluding execve() among many > others. > > v2: * ctx changed to main_loop_ctx > * seccomp_on now inside ifdef > * open syscall added to the main_loop whitelist > > Signed-off-by: Eduardo Otubo > --- > qemu-seccomp.c | 99 ++++++++++++++++++++++++++++++++++++++++++++++++++++------ > qemu-seccomp.h | 7 ++++- > vl.c | 21 +++++++++++-- > 3 files changed, 114 insertions(+), 13 deletions(-) > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index a7b33e2..033cfad 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -13,6 +13,7 @@ > * GNU GPL, version 2 or (at your option) any later version. > */ > #include > +#include > #include > #include "qemu-seccomp.h" > > @@ -21,7 +22,7 @@ struct QemuSeccompSyscall { > uint8_t priority; > }; > > -static const struct QemuSeccompSyscall seccomp_whitelist[] = { > +static const struct QemuSeccompSyscall seccomp_whitelist_init[] = { > { SCMP_SYS(timer_settime), 255 }, > { SCMP_SYS(timer_gettime), 254 }, > { SCMP_SYS(futex), 253 }, > @@ -121,27 +122,107 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { > { SCMP_SYS(rt_sigtimedwait), 242 } > }; > > -int seccomp_start(void) > +static const struct QemuSeccompSyscall seccomp_whitelist_main_loop[] = { > + { SCMP_SYS(timer_settime), 255 }, > + { SCMP_SYS(timer_gettime), 254 }, > + { SCMP_SYS(futex), 253 }, > + { SCMP_SYS(select), 252 }, > + { SCMP_SYS(recvfrom), 251 }, > + { SCMP_SYS(sendto), 250 }, > + { SCMP_SYS(read), 249 }, > + { SCMP_SYS(brk), 248 }, > + { SCMP_SYS(mmap), 247 }, > + { SCMP_SYS(open), 247 }, > +#if defined(__i386__) > + { SCMP_SYS(fcntl64), 245 }, > + { SCMP_SYS(fstat64), 245 }, > + { SCMP_SYS(stat64), 245 }, > + { SCMP_SYS(getgid32), 245 }, > + { SCMP_SYS(getegid32), 245 }, > + { SCMP_SYS(getuid32), 245 }, > + { SCMP_SYS(geteuid32), 245 }, > + { SCMP_SYS(sigreturn), 245 }, > + { SCMP_SYS(_newselect), 245 }, > + { SCMP_SYS(_llseek), 245 }, > + { SCMP_SYS(mmap2), 245}, > + { SCMP_SYS(sigprocmask), 245 }, > +#endif > + { SCMP_SYS(exit), 245 }, > + { SCMP_SYS(timer_delete), 245 }, > + { SCMP_SYS(exit_group), 245 }, > + { SCMP_SYS(rt_sigreturn), 245 }, > + { SCMP_SYS(madvise), 245 }, > + { SCMP_SYS(write), 244 }, > + { SCMP_SYS(fcntl), 243 }, > + { SCMP_SYS(tgkill), 242 }, > + { SCMP_SYS(rt_sigaction), 242 }, > + { SCMP_SYS(pipe2), 242 }, > + { SCMP_SYS(munmap), 242 }, > + { SCMP_SYS(mremap), 242 }, > + { SCMP_SYS(getsockname), 242 }, > + { SCMP_SYS(getpeername), 242 }, > + { SCMP_SYS(close), 242 }, > + { SCMP_SYS(accept4), 242 }, > + { SCMP_SYS(eventfd2), 242 }, > + { SCMP_SYS(recvmsg), 242 }, > + { SCMP_SYS(ioctl), 242 }, > + { SCMP_SYS(rt_sigprocmask), 242 } > +}; > + > +static int > +process_whitelist(const struct QemuSeccompSyscall *whitelist, > + unsigned int size, scmp_filter_ctx *ctx) > { > int rc = 0; > + > unsigned int i = 0; > - scmp_filter_ctx ctx; > + > + for (i = 0; i < size; i++) { > + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, whitelist[i].num, 0); > + if (rc < 0) { > + return -1; > + } > + > + rc = seccomp_syscall_priority(ctx, whitelist[i].num, > + whitelist[i].priority); > + if (rc < 0) { > + return -1; > + } > + } > + return 0; > +} > + > +int > +seccomp_start(enum whitelist_mode mode, scmp_filter_ctx *ctx) > +{ > + int rc = 0; > > ctx = seccomp_init(SCMP_ACT_KILL); Is there any reason why ctx can't be a local variable in this function? It is allocated and freed on each entry and exit in this function. > if (ctx == NULL) { > + rc = -1; > goto seccomp_return; > } > > - for (i = 0; i < ARRAY_SIZE(seccomp_whitelist); i++) { > - rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, seccomp_whitelist[i].num, 0); > - if (rc < 0) { > + switch (mode) { > + case INIT: > + if (process_whitelist > + (seccomp_whitelist_init, > + ARRAY_SIZE(seccomp_whitelist_init), ctx) < 0) { > + rc = -1; > goto seccomp_return; > } > - rc = seccomp_syscall_priority(ctx, seccomp_whitelist[i].num, > - seccomp_whitelist[i].priority); > - if (rc < 0) { > + break; > + case MAIN_LOOP: > + if (process_whitelist > + (seccomp_whitelist_main_loop, > + ARRAY_SIZE(seccomp_whitelist_main_loop), ctx) < 0) { > + rc = -1; > goto seccomp_return; > } > + break; > + default: > + rc = -1; > + goto seccomp_return; > } > > rc = seccomp_load(ctx); > diff --git a/qemu-seccomp.h b/qemu-seccomp.h > index b2fc3f8..1c97978 100644 > --- a/qemu-seccomp.h > +++ b/qemu-seccomp.h > @@ -18,5 +18,10 @@ > #include > #include "osdep.h" > > -int seccomp_start(void); > +enum whitelist_mode { > + INIT = 0, > + MAIN_LOOP = 1, > +}; > + > +int seccomp_start(enum whitelist_mode mode, scmp_filter_ctx *ctx); > #endif > diff --git a/vl.c b/vl.c > index bec68cd..d50018f 100644 > --- a/vl.c > +++ b/vl.c > @@ -774,10 +774,11 @@ static int bt_parse(const char *opt) > return 1; > } > > -static int install_seccomp_filters(void) > +static int > +install_seccomp_filters(enum whitelist_mode mode, scmp_filter_ctx *ctx) > { > #ifdef CONFIG_SECCOMP > - if (seccomp_start() < 0) { > + if (seccomp_start(mode, ctx) < 0) { > qerror_report(ERROR_CLASS_GENERIC_ERROR, > "failed to install seccomp syscall filter in the kernel"); I heard from Luiz Capitulino on one of my patches that qerror_report() is deprecated. So you'll want to update this. > return -1; > @@ -2407,6 +2408,10 @@ int main(int argc, char **argv, char **envp) > const char *trace_events = NULL; > const char *trace_file = NULL; > > +#ifdef CONFIG_SECCOMP > + scmp_filter_ctx main_loop_ctx; > +#endif > + > atexit(qemu_run_exit_notifiers); > error_set_progname(argv[0]); > > @@ -3330,11 +3335,13 @@ int main(int argc, char **argv, char **envp) > } > > /* We should install seccomp filters even if -sandbox on is not used. */ > +#ifdef CONFIG_SECCOMP > if (seccomp_on) { > - if (install_seccomp_filters() < 0) { > + if (install_seccomp_filters(INIT, &main_loop_ctx) < 0) { I don't think the variable name "main_loop_ctx" makes sense here. Should the name be more generic since it's used wherever a seccomp filter is installed? > exit(1); > } > } > +#endif > > if (machine == NULL) { > fprintf(stderr, "No machine found.\n"); > @@ -3794,6 +3801,14 @@ int main(int argc, char **argv, char **envp) > > os_setup_post(); > > +#ifdef CONFIG_SECCOMP > + if (seccomp_on) { > + if (install_seccomp_filters(MAIN_LOOP, &main_loop_ctx) < 0) { > + exit(1); > + } > + } > +#endif > + > resume_all_vcpus(); > main_loop(); > bdrv_close_all(); > -- Regards, Corey Bryant