Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist

[Eduardo Otubo <otubo@linux.vnet.ibm.com>]

On 09/17/2013 04:17 PM, Corey Bryant wrote:
>
>
> On 09/17/2013 01:14 PM, Eduardo Otubo wrote:
>>
>>
>> On 09/17/2013 11:43 AM, Paul Moore wrote:
>>> On Tuesday, September 17, 2013 02:06:06 PM Daniel P. Berrange wrote:
>>>> On Tue, Sep 17, 2013 at 10:01:23AM -0300, Eduardo Otubo wrote:
>>>>
>>>>> Paul, what exactly are you planning to add to libvirt? I'm not a big
>>>>> fan of using qemu command line to pass syscalls for blacklist as
>>>>> arguments, but I can't see other way to avoid problems (like -net
>>>>> bridge / -net tap) from happening.
>>>
>>> At present, and as far as I'm concerned pretty much everything is open
>>> for
>>> discussion, the code works similar to the libvirt network filters.
>>> You create
>>> a separate XML configuration file which defines the filter and you
>>> reference
>>> that filter from the domain's XML configuration.  When a QEMU/KVM or
>>> LXC based
>>> domain starts it uses libseccomp to create the seccomp filter and then
>>> loads
>>> it into the kernel after the fork but before the domain is exec'd.
>>
>> Clever approach. I tihnk a possible way to do this is something like:
>>
>>   -sandbox
>> -on[,strict=<on|off>][,whitelist=qemu_whitelist.conf][,blacklist=qemu_blacklist.conf]
>>
>>
>>
>>      where:
>>
>> [,whitelist=qemu_whitelist.conf] will override default whitelist filter
>> [,blacklist=blacklist.conf] will override default blacklist filter
>>
>> But when we add seccomp support for qemu on libvirt, we make sure to
>> just add -sandbox off and use Paul's approach.
>>
>> Is that a reasonable approach? What do you think?
>>
>
> QEMU wouldn't require any changes for the approach Paul describes. The
> QEMU process that is exec'd by libvirt would be constrained by the
> filter that libvirt installed.
>

Yes, that is correct. But I'm thinking about the case when Qemu is run 
stand-alone, without libvirt. There must be a way to configure it 
without using a pre configured filter from libvirt.

-- 
Eduardo Otubo
IBM Linux Technology Center