From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45579) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Uz9Ku-0002El-6u for qemu-devel@nongnu.org; Tue, 16 Jul 2013 13:46:53 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1Uz9Kt-0004u6-1s for qemu-devel@nongnu.org; Tue, 16 Jul 2013 13:46:52 -0400 Received: from e24smtp05.br.ibm.com ([32.104.18.26]:58036) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Uz9Ks-0004tj-Lm for qemu-devel@nongnu.org; Tue, 16 Jul 2013 13:46:50 -0400 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 16 Jul 2013 14:46:49 -0300 Received: from d24relay03.br.ibm.com (d24relay03.br.ibm.com [9.13.184.25]) by d24dlp02.br.ibm.com (Postfix) with ESMTP id C6A731DC005C for ; Tue, 16 Jul 2013 13:46:47 -0400 (EDT) Received: from d24av01.br.ibm.com (d24av01.br.ibm.com [9.8.31.91]) by d24relay03.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r6GHjUUm28705004 for ; Tue, 16 Jul 2013 14:45:30 -0300 Received: from d24av01.br.ibm.com (localhost [127.0.0.1]) by d24av01.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r6GHklIT002647 for ; Tue, 16 Jul 2013 14:46:47 -0300 Message-ID: <51E58706.6080305@linux.vnet.ibm.com> Date: Tue, 16 Jul 2013 14:46:46 -0300 From: Eduardo Otubo MIME-Version: 1.0 References: <1373909379-21372-1-git-send-email-otubo@linux.vnet.ibm.com> <1373909379-21372-2-git-send-email-otubo@linux.vnet.ibm.com> <2186539.dUKsGWFR1D@sifl> In-Reply-To: <2186539.dUKsGWFR1D@sifl> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 1/2] seccomp: no need to check arch in syscall whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paul Moore Cc: coreyb@linux.vnet.ibm.com, qemu-devel@nongnu.org On 07/15/2013 03:55 PM, Paul Moore wrote: > On Monday, July 15, 2013 02:29:37 PM Eduardo Otubo wrote: >> Since libseccomp 2.0 there's no need to check the architecture type >> anymore. >> >> Signed-off-by: Eduardo Otubo >> --- >> qemu-seccomp.c | 13 ------------- >> 1 file changed, 13 deletions(-) > > Good, this should make long term maintenance easier. However, you should > probably update the configure script to require libseccomp-2.0.0 or greater. > Actually, since this is 1.6 material, I would make it dependent on > libseccomp-2.1.0 as there are a number of improvements in that release and it > has been out for a while now. Great tip, Paul. Doing this on v2. > > If you're feeling particularly adventurous, you could even enable the QEMU > seccomp code for x32/ARM hosts with libseccomp-2.1.0 hosts :) One step at a time :-) Perhaps for Qemu 1.7? > >> diff --git a/qemu-seccomp.c b/qemu-seccomp.c >> index ca123bf..1d5fd71 100644 >> --- a/qemu-seccomp.c >> +++ b/qemu-seccomp.c >> @@ -26,12 +26,9 @@ static const struct QemuSeccompSyscall >> seccomp_whitelist[] = { { SCMP_SYS(timer_gettime), 254 }, >> { SCMP_SYS(futex), 253 }, >> { SCMP_SYS(select), 252 }, >> -#if defined(__x86_64__) >> { SCMP_SYS(recvfrom), 251 }, >> { SCMP_SYS(sendto), 250 }, >> -#elif defined(__i386__) >> { SCMP_SYS(socketcall), 250 }, >> -#endif >> { SCMP_SYS(read), 249 }, >> { SCMP_SYS(brk), 248 }, >> { SCMP_SYS(clone), 247 }, >> @@ -40,7 +37,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] >> = { { SCMP_SYS(execve), 245 }, >> { SCMP_SYS(open), 245 }, >> { SCMP_SYS(ioctl), 245 }, >> -#if defined(__x86_64__) >> { SCMP_SYS(socket), 245 }, >> { SCMP_SYS(setsockopt), 245 }, >> { SCMP_SYS(recvmsg), 245 }, >> @@ -51,9 +47,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] >> = { { SCMP_SYS(bind), 245 }, >> { SCMP_SYS(listen), 245 }, >> { SCMP_SYS(semget), 245 }, >> -#elif defined(__i386__) >> { SCMP_SYS(ipc), 245 }, >> -#endif >> { SCMP_SYS(gettimeofday), 245 }, >> { SCMP_SYS(readlink), 245 }, >> { SCMP_SYS(access), 245 }, >> @@ -64,7 +58,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] >> = { { SCMP_SYS(statfs), 245 }, >> { SCMP_SYS(unlink), 245 }, >> { SCMP_SYS(wait4), 245 }, >> -#if defined(__i386__) >> { SCMP_SYS(fcntl64), 245 }, >> { SCMP_SYS(fstat64), 245 }, >> { SCMP_SYS(stat64), 245 }, >> @@ -77,7 +70,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] >> = { { SCMP_SYS(_llseek), 245 }, >> { SCMP_SYS(mmap2), 245 }, >> { SCMP_SYS(sigprocmask), 245 }, >> -#endif >> { SCMP_SYS(sched_getparam), 245 }, >> { SCMP_SYS(sched_getscheduler), 245 }, >> { SCMP_SYS(fstat), 245 }, >> @@ -145,9 +137,7 @@ static const struct QemuSeccompSyscall >> seccomp_whitelist[] = { { SCMP_SYS(epoll_create), 242 }, >> { SCMP_SYS(epoll_ctl), 242 }, >> { SCMP_SYS(epoll_wait), 242 }, >> -#if defined(__i386__) >> { SCMP_SYS(waitpid), 242 }, >> -#elif defined(__x86_64__) >> { SCMP_SYS(getsockname), 242 }, >> { SCMP_SYS(getpeername), 242 }, >> { SCMP_SYS(accept4), 242 }, >> @@ -159,7 +149,6 @@ static const struct QemuSeccompSyscall >> seccomp_whitelist[] = { { SCMP_SYS(semtimedop), 241 }, >> { SCMP_SYS(epoll_ctl_old), 241 }, >> { SCMP_SYS(epoll_wait_old), 241 }, >> -#endif >> { SCMP_SYS(epoll_pwait), 241 }, >> { SCMP_SYS(epoll_create1), 241 }, >> { SCMP_SYS(ppoll), 241 }, >> @@ -174,7 +163,6 @@ static const struct QemuSeccompSyscall >> seccomp_whitelist[] = { { SCMP_SYS(getresuid), 241 }, >> { SCMP_SYS(getresgid), 241 }, >> { SCMP_SYS(getgroups), 241 }, >> -#if defined(__i386__) >> { SCMP_SYS(getresuid32), 241 }, >> { SCMP_SYS(getresgid32), 241 }, >> { SCMP_SYS(getgroups32), 241 }, >> @@ -193,7 +181,6 @@ static const struct QemuSeccompSyscall >> seccomp_whitelist[] = { { SCMP_SYS(lstat64), 241 }, >> { SCMP_SYS(sendfile64), 241 }, >> { SCMP_SYS(ugetrlimit), 241 }, >> -#endif >> { SCMP_SYS(alarm), 241 }, >> { SCMP_SYS(rt_sigsuspend), 241 }, >> { SCMP_SYS(rt_sigqueueinfo), 241 }, -- Eduardo Otubo IBM Linux Technology Center