From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:36829) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VLuuT-0004jO-Fv for qemu-devel@nongnu.org; Tue, 17 Sep 2013 09:01:50 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VLuuK-0001Uu-Ib for qemu-devel@nongnu.org; Tue, 17 Sep 2013 09:01:41 -0400 Received: from e24smtp03.br.ibm.com ([32.104.18.24]:39241) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VLuuK-0001UP-58 for qemu-devel@nongnu.org; Tue, 17 Sep 2013 09:01:32 -0400 Received: from /spool/local by e24smtp03.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Tue, 17 Sep 2013 10:01:29 -0300 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 2F1033520065 for ; Tue, 17 Sep 2013 09:01:26 -0400 (EDT) Received: from d24av05.br.ibm.com (d24av05.br.ibm.com [9.18.232.44]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r8HCuPwl2535472 for ; Tue, 17 Sep 2013 09:56:26 -0300 Received: from d24av05.br.ibm.com (d24av05 [127.0.0.1]) by d24av05.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r8HD1PK5009277 for ; Tue, 17 Sep 2013 09:01:25 -0400 Message-ID: <523852A3.3070207@linux.vnet.ibm.com> Date: Tue, 17 Sep 2013 10:01:23 -0300 From: Eduardo Otubo MIME-Version: 1.0 References: <1378495308-24560-1-git-send-email-otubo@linux.vnet.ibm.com> <1378495308-24560-3-git-send-email-otubo@linux.vnet.ibm.com> <52309E42.2080802@linux.vnet.ibm.com> <20130911164913.GI2293@redhat.com> In-Reply-To: <20130911164913.GI2293@redhat.com> Content-Type: text/plain; charset=UTF-8; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: "Daniel P. Berrange" Cc: pmoore@redhat.com, Corey Bryant , qemu-devel@nongnu.org On 09/11/2013 01:49 PM, Daniel P. Berrange wrote: > On Wed, Sep 11, 2013 at 12:45:54PM -0400, Corey Bryant wrote: >> >> >> On 09/06/2013 03:21 PM, Eduardo Otubo wrote: >>> New command line options for the seccomp blacklist feature: >>> >>> $ qemu -sandbox on[,strict=] >>> >>> The strict parameter will turn on or off the new system call blacklist >> >> I mentioned this before but I'll say it again since I think it needs >> to be discussed. Since this regresses support (it'll prevent -net >> bridge and -net tap from using execv) the concern I have with the >> strict=on|off option is whether or not we will have the flexibility >> to modify the blacklist once QEMU is released with this support. Of >> course we should be able to add more syscalls to the blacklist as >> long as they don't regress QEMU functionality. But if we want to >> add a syscall that does regress QEMU functionality, I think we'd >> have to add a new command line option, which doesn't seem desirable. >> >> So a more flexible approach may be necessary. Maybe the blacklist >> should be passed on the command line, which would enable it to be >> defined by libvirt and passed to QEMU. I know Paul is working on >> something for libvirt so maybe that answers this question. Paul, what exactly are you planning to add to libvirt? I'm not a big fan of using qemu command line to pass syscalls for blacklist as arguments, but I can't see other way to avoid problems (like -net bridge / -net tap) from happening. > > On the face of it, I'm not at all a fan of the idea of libvirt having > to pass a syscall whitelist/blacklist to QEMU. IMHO that would be > exposing too much knowledge of QEMU impl details to libvirt. > > Daniel > -- Eduardo Otubo IBM Linux Technology Center