From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:37307) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VYzea-0003A3-Pm for qemu-devel@nongnu.org; Wed, 23 Oct 2013 10:43:28 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1VYzeR-0006DI-Vq for qemu-devel@nongnu.org; Wed, 23 Oct 2013 10:43:20 -0400 Received: from e24smtp05.br.ibm.com ([32.104.18.26]:39464) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1VYzeR-0006Cb-Ik for qemu-devel@nongnu.org; Wed, 23 Oct 2013 10:43:11 -0400 Received: from /spool/local by e24smtp05.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 23 Oct 2013 12:43:08 -0200 Received: from d24relay01.br.ibm.com (d24relay01.br.ibm.com [9.8.31.16]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 988733520060 for ; Wed, 23 Oct 2013 10:43:06 -0400 (EDT) Received: from d24av03.br.ibm.com (d24av03.br.ibm.com [9.8.31.95]) by d24relay01.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id r9NEh8Q72515184 for ; Wed, 23 Oct 2013 12:43:08 -0200 Received: from d24av03.br.ibm.com (localhost [127.0.0.1]) by d24av03.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id r9NEgZfn004424 for ; Wed, 23 Oct 2013 12:42:35 -0200 Message-ID: <5267E05A.1010601@linux.vnet.ibm.com> Date: Wed, 23 Oct 2013 12:42:34 -0200 From: Eduardo Otubo MIME-Version: 1.0 References: <1382440906-3852-1-git-send-email-otubo@linux.vnet.ibm.com> In-Reply-To: Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH for-1.7] seccomp: setting "-sandbox on" by default List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Anthony Liguori Cc: Paul Moore , coreyb@linux.vnet.ibm.com, qemu-devel On 10/22/2013 11:00 AM, Anthony Liguori wrote: > On Tue, Oct 22, 2013 at 12:21 PM, Eduardo Otubo > wrote: >> Inverting the way sandbox handles arguments, making possible to have no >> argument and still have '-sandbox on' enabled. >> >> Signed-off-by: Eduardo Otubo >> --- >> >> The option '-sandbox on' is now used by default by virt-test[0] -- it has been >> merged into the 'next' branch and will be available in the next release, >> meaning we have a back support for regression tests if anything breaks because >> of some missing system call not listed in the whitelist. >> >> This being said, I think it makes sense to have this option set to 'on' by >> default in the next Qemu version. It's been a while since no missing syscall is >> reported and at this point the whitelist seems to be pretty mature. >> >> [0] - https://github.com/autotest/virt-test/commit/50e1f7d47a94f4c770880cd8ec0f18365dcba714 > > This breaks hot_add of a network device that uses a script= argument, correct? > > If so, this cannot be made default. Anthony, I believe you're talking about the blacklist feature. This is the old whitelist that is already upstream and it does not block any network device to be hot plugged. > > Regards, > > Anthony Liguori > >> >> qemu-options.hx | 4 ++-- >> vl.c | 47 ++++++++++++++++++++++++++++------------------- >> 2 files changed, 30 insertions(+), 21 deletions(-) >> >> diff --git a/qemu-options.hx b/qemu-options.hx >> index 5dc8b75..315a86d 100644 >> --- a/qemu-options.hx >> +++ b/qemu-options.hx >> @@ -2982,13 +2982,13 @@ Old param mode (ARM only). >> ETEXI >> >> DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \ >> - "-sandbox Enable seccomp mode 2 system call filter (default 'off').\n", >> + "-sandbox Enable seccomp mode 2 system call filter (default 'on').\n", >> QEMU_ARCH_ALL) >> STEXI >> @item -sandbox @var{arg} >> @findex -sandbox >> Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will >> -disable it. The default is 'off'. >> +disable it. The default is 'on'. >> ETEXI >> >> DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig, >> diff --git a/vl.c b/vl.c >> index b42ac67..ae3bdc9 100644 >> --- a/vl.c >> +++ b/vl.c >> @@ -529,6 +529,20 @@ static QemuOptsList qemu_msg_opts = { >> }, >> }; >> >> +static QemuOpts *qemu_get_sandbox_opts(void) >> +{ >> + QemuOptsList *list; >> + QemuOpts *opts; >> + >> + list = qemu_find_opts("sandbox"); >> + assert(list); >> + opts = qemu_opts_find(list, NULL); >> + if (!opts) { >> + opts = qemu_opts_create_nofail(list); >> + } >> + return opts; >> +} >> + >> /** >> * Get machine options >> * >> @@ -960,24 +974,9 @@ static int bt_parse(const char *opt) >> return 1; >> } >> >> -static int parse_sandbox(QemuOpts *opts, void *opaque) >> +static bool sandbox_enabled(bool default_usb) >> { >> - /* FIXME: change this to true for 1.3 */ >> - if (qemu_opt_get_bool(opts, "enable", false)) { >> -#ifdef CONFIG_SECCOMP >> - if (seccomp_start() < 0) { >> - qerror_report(ERROR_CLASS_GENERIC_ERROR, >> - "failed to install seccomp syscall filter in the kernel"); >> - return -1; >> - } >> -#else >> - qerror_report(ERROR_CLASS_GENERIC_ERROR, >> - "sandboxing request but seccomp is not compiled into this build"); >> - return -1; >> -#endif >> - } >> - >> - return 0; >> + return qemu_opt_get_bool(qemu_get_sandbox_opts(), "sandbox", default_usb); >> } >> >> bool usb_enabled(bool default_usb) >> @@ -3806,8 +3805,18 @@ int main(int argc, char **argv, char **envp) >> exit(1); >> } >> >> - if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL, 0)) { >> - exit(1); >> + if (sandbox_enabled(true)) { >> +#ifdef CONFIG_SECCOMP >> + if (seccomp_start() < 0) { >> + qerror_report(ERROR_CLASS_GENERIC_ERROR, >> + "failed to install seccomp syscall filter in the kernel"); >> + return -1; >> + } >> +#else >> + qerror_report(ERROR_CLASS_GENERIC_ERROR, >> + "sandboxing request but seccomp is not compiled into this build"); >> + return -1; >> +#endif >> } >> >> #ifndef _WIN32 >> -- >> 1.8.3.1 >> > -- Eduardo Otubo IBM Linux Technology Center