From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:45090) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VFPbL-0002XM-UQ for qemu-devel@nongnu.org; Fri, 30 Aug 2013 10:23:13 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VFPbD-0007K0-18 for qemu-devel@nongnu.org; Fri, 30 Aug 2013 10:23:03 -0400 Received: from e24smtp04.br.ibm.com ([32.104.18.25]:46644) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VFPbC-0007Jh-Kc for qemu-devel@nongnu.org; Fri, 30 Aug 2013 10:22:54 -0400 Received: from /spool/local by e24smtp04.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Fri, 30 Aug 2013 11:22:53 -0300 Received: from d24relay03.br.ibm.com (d24relay03.br.ibm.com [9.13.184.25]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 24BB13520060 for ; Fri, 30 Aug 2013 10:22:50 -0400 (EDT) Received: from d24av05.br.ibm.com (d24av05.br.ibm.com [9.18.232.44]) by d24relay03.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r7UELLQT24903882 for ; Fri, 30 Aug 2013 11:21:21 -0300 Received: from d24av05.br.ibm.com (d24av05 [127.0.0.1]) by d24av05.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r7UEMn8f019479 for ; Fri, 30 Aug 2013 10:22:49 -0400 Message-ID: <5220AAB8.4070404@linux.vnet.ibm.com> Date: Fri, 30 Aug 2013 11:22:48 -0300 From: Eduardo Otubo MIME-Version: 1.0 References: <1377738272-3470-1-git-send-email-otubo@linux.vnet.ibm.com> <20130829083411.GD23096@stefanha-thinkpad.redhat.com> <521F0CCC.1010301@redhat.com> In-Reply-To: <521F0CCC.1010301@redhat.com> Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Paolo Bonzini Cc: pmoore@redhat.com, Stefan Hajnoczi , coreyb@linux.vnet.ibm.com, wad@chromium.org, qemu-devel@nongnu.org On 08/29/2013 05:56 AM, Paolo Bonzini wrote: > Il 29/08/2013 10:34, Stefan Hajnoczi ha scritto: >> On Wed, Aug 28, 2013 at 10:04:32PM -0300, Eduardo Otubo wrote: >>> Now there's a second whitelist, right before the vcpu starts. The second >>> whitelist is the same as the first one, except for exec() and select(). >> >> -netdev tap,downscript=/path/to/script requires exec() in the QEMU >> shutdown code path. Will this work with seccomp? > > It won't by design (seccomp is supposed to run with file descriptor > passing). > > However, removing select() seems a bit risky. We cannot exclude that > external libraries are not using it instead of, say, poll. > > BTW, recent QEMU is using ppoll instead of poll; does the whitelist > require an update? It might need some update, yes. I'll run some other tests with this specific syscall and, if needed, I'll send another patch for the whitelist update. Thanks for pointing that, Paolo. > > Paolo > -- Eduardo Otubo IBM Linux Technology Center