Re: [Qemu-devel] [PATCH] seccomp: add timerfd_create and timerfd_settime to the whitelist

[Eduardo Otubo <otubo@linux.vnet.ibm.com>]

On 01/28/2014 04:03 PM, Felix Geyer wrote:
> On 28.01.2014 14:00, Eduardo Otubo wrote:
>> On 01/26/2014 10:21 AM, Felix Geyer wrote:
>>> libusb calls timerfd_create() and timerfd_settime() when it's built with
>>> timerfd support.
>>>
>>> Command to reproduce:
>>>
>>> qemu -sandbox on -monitor stdio -device piix3-usb-uhci,id=usb
>>>        -device usb-host,hostbus=1,hostaddr=3,id=hostdev0
>>>
>>> Log messages:
>>>
>>> audit(1390730418.924:135): auid=4294967295 uid=121 gid=103 ses=4294967295
>>>                              pid=5232 comm="qemu-system-x86" sig=31 syscall=283
>>>                              compat=0 ip=0x7f2b0f4e96a7 code=0x0
>>> audit(1390733100.580:142): auid=4294967295 uid=121 gid=103 ses=4294967295
>>>                              pid=16909 comm="qemu-system-x86" sig=31 syscall=286
>>>                              compat=0 ip=0x7f03513a06da code=0x0
>>>
>>> Signed-off-by: Felix Geyer <debfx@fobos.de>
>>> ---
>>>    qemu-seccomp.c | 4 +++-
>>>    1 file changed, 3 insertions(+), 1 deletion(-)
>>>
>>> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
>>> index caa926e..2705468 100644
>>> --- a/qemu-seccomp.c
>>> +++ b/qemu-seccomp.c
>>> @@ -225,7 +225,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>>>        { SCMP_SYS(fchmod), 240 },
>>>        { SCMP_SYS(shmget), 240 },
>>>        { SCMP_SYS(shmat), 240 },
>>> -    { SCMP_SYS(shmdt), 240 }
>>> +    { SCMP_SYS(shmdt), 240 },
>>> +    { SCMP_SYS(timerfd_create), 240 },
>>> +    { SCMP_SYS(timerfd_settime), 240 }
>>
>> Did you deliberately set the priority to 240? Or did you run any sort of benchmark (strace) to
>> find this value?
>>
>> Regards,
>
> Not really, sorry.
>
> I've now done a benchmark on x86_64, copying a few hundred MB from a USB drive:
>
>      calls  syscall
>   --------- ----------------
>     5303600 write
>     2240554 read
>     2167030 ppoll
>     2134828 ioctl
>      704023 timerfd_settime
>      689105 poll
>       83122 futex
>         803 writev
>         476 rt_sigprocmask
>         287 recvmsg
>         178 brk
>
> timerfd_create is basically only called once so it can have the lowest priority.
> timerfd_settime should probably have priority around 242.

Fair enough. Please send another patch fixing the priority values and 
I'll ACK. I usually send pull requests at Friday EOD. So if you need 
anything to be pull-requested until this Friday, please send so we can 
discuss and ACK until there.

Thanks for the contribution :)

-- 
Eduardo Otubo
IBM Linux Technology Center