[Qemu-devel] [PATCH] Whitelist sysinfo call

[Qemu-devel] [PATCH] Whitelist sysinfo call

[mrezanin]

From: Miroslav Rezanina <mrezanin@redhat.com>

Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
so qemu using rbd image hang after start when run in sandbox mode.

To allow using rbd images in sandbox mode we have to whitelist it.

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
 qemu-seccomp.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 2866e3c..e29fca1 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
 #ifdef HAVE_CACHEFLUSH
     { SCMP_SYS(cacheflush), 240 },
 #endif
+    { SCMP_SYS(sysinfo), 240 },
 };
 
 int seccomp_start(void)
-- 
2.5.0

Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Eduardo Otubo]

[-- Attachment #1: Type: text/plain, Size: 1002 bytes --]

On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote:
> From: Miroslav Rezanina <mrezanin@redhat.com>
> 
> Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> so qemu using rbd image hang after start when run in sandbox mode.
> 
> To allow using rbd images in sandbox mode we have to whitelist it.
> 
> Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> ---
>  qemu-seccomp.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 2866e3c..e29fca1 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>  #ifdef HAVE_CACHEFLUSH
>      { SCMP_SYS(cacheflush), 240 },
>  #endif
> +    { SCMP_SYS(sysinfo), 240 },

Are you sure you want to add this syscall to the bottom of the list? Did
you estimate the frequency it is called by running strace?

Thanks for the patch.

-- 
Eduardo Otubo
ProfitBricks GmbH

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Miroslav Rezanina]

----- 元のメッセージ -----
> 差出人: "Eduardo Otubo" <eduardo.otubo@profitbricks.com>
> 宛先: mrezanin@redhat.com
> Cc: qemu-devel@nongnu.org, armbru@redhat.com
> 送信済み: 2016年3月11日, 金曜日 午前 9:51:50
> 件名: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> 
> On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote:
> > From: Miroslav Rezanina <mrezanin@redhat.com>
> > 
> > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > so qemu using rbd image hang after start when run in sandbox mode.
> > 
> > To allow using rbd images in sandbox mode we have to whitelist it.
> > 
> > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> > ---
> >  qemu-seccomp.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 2866e3c..e29fca1 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = {
> >  #ifdef HAVE_CACHEFLUSH
> >      { SCMP_SYS(cacheflush), 240 },
> >  #endif
> > +    { SCMP_SYS(sysinfo), 240 },
> 
> Are you sure you want to add this syscall to the bottom of the list? Did
> you estimate the frequency it is called by running strace?
> 
> Thanks for the patch.
> 
Hi,

Yes, it wasn't used before nss update and now is used only for rbd based images
where it is called just few times upon start so drawback should be minimal. With
this we do not change cost of other calls.

Thanks for review and question,
Mirek

> --
> Eduardo Otubo
> ProfitBricks GmbH
> 

-- 
Miroslav Rezanina
Software Engineer - Virtualization Team

Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Eduardo Otubo]

[-- Attachment #1: Type: text/plain, Size: 1900 bytes --]

On Mon, Mar 21, 2016 at 08=17=45AM -0400, Miroslav Rezanina wrote:
> 
> 
> ----- 元のメッセージ -----
> > 差出人: "Eduardo Otubo" <eduardo.otubo@profitbricks.com>
> > 宛先: mrezanin@redhat.com
> > Cc: qemu-devel@nongnu.org, armbru@redhat.com
> > 送信済み: 2016年3月11日, 金曜日 午前 9:51:50
> > 件名: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> > 
> > On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote:
> > > From: Miroslav Rezanina <mrezanin@redhat.com>
> > > 
> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > > so qemu using rbd image hang after start when run in sandbox mode.
> > > 
> > > To allow using rbd images in sandbox mode we have to whitelist it.
> > > 
> > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> > > ---
> > >  qemu-seccomp.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > > index 2866e3c..e29fca1 100644
> > > --- a/qemu-seccomp.c
> > > +++ b/qemu-seccomp.c
> > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > > seccomp_whitelist[] = {
> > >  #ifdef HAVE_CACHEFLUSH
> > >      { SCMP_SYS(cacheflush), 240 },
> > >  #endif
> > > +    { SCMP_SYS(sysinfo), 240 },
> > 
> > Are you sure you want to add this syscall to the bottom of the list? Did
> > you estimate the frequency it is called by running strace?
> > 
> > Thanks for the patch.
> > 
> Hi,
> 
> Yes, it wasn't used before nss update and now is used only for rbd based images
> where it is called just few times upon start so drawback should be minimal. With
> this we do not change cost of other calls.
> 
> Thanks for review and question,
> Mirek

Ok. So, ACK on this patch. I'll roll out a pull request by the end of
the day.
Thanks for the contribution.


-- 
Eduardo Otubo
ProfitBricks GmbH

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Serge Hallyn]

Quoting mrezanin@redhat.com (mrezanin@redhat.com):
> From: Miroslav Rezanina <mrezanin@redhat.com>
> 
> Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> so qemu using rbd image hang after start when run in sandbox mode.
> 
> To allow using rbd images in sandbox mode we have to whitelist it.
> 
> Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

Thanks.

Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

> ---
>  qemu-seccomp.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 2866e3c..e29fca1 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>  #ifdef HAVE_CACHEFLUSH
>      { SCMP_SYS(cacheflush), 240 },
>  #endif
> +    { SCMP_SYS(sysinfo), 240 },
>  };
>  
>  int seccomp_start(void)
> -- 
> 2.5.0
> 
> 

Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Eduardo Otubo]

[-- Attachment #1: Type: text/plain, Size: 1204 bytes --]

On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote:
> Quoting mrezanin@redhat.com (mrezanin@redhat.com):
> > From: Miroslav Rezanina <mrezanin@redhat.com>
> > 
> > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > so qemu using rbd image hang after start when run in sandbox mode.
> > 
> > To allow using rbd images in sandbox mode we have to whitelist it.
> > 
> > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> 
> Thanks.
> 
> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Also: I'll change the subject of this email a little bit for a cleaner
and more explicit commit.

Thanks.

> 
> > ---
> >  qemu-seccomp.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 2866e3c..e29fca1 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> >  #ifdef HAVE_CACHEFLUSH
> >      { SCMP_SYS(cacheflush), 240 },
> >  #endif
> > +    { SCMP_SYS(sysinfo), 240 },
> >  };
> >  
> >  int seccomp_start(void)
> > -- 
> > 2.5.0
> > 
> > 
> 

-- 
Eduardo Otubo
ProfitBricks GmbH

[-- Attachment #2: Digital signature --]
[-- Type: application/pgp-signature, Size: 473 bytes --]

Re: [Qemu-devel] [PATCH] Whitelist sysinfo call

[Miroslav Rezanina]

----- 元のメッセージ -----
> 差出人: "Eduardo Otubo" <eduardo.otubo@profitbricks.com>
> 宛先: "Serge Hallyn" <serge.hallyn@ubuntu.com>
> Cc: mrezanin@redhat.com, qemu-devel@nongnu.org, armbru@redhat.com
> 送信済み: 2016年4月12日, 火曜日 午後 1:53:47
> 件名: Re: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> 
> On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote:
> > Quoting mrezanin@redhat.com (mrezanin@redhat.com):
> > > From: Miroslav Rezanina <mrezanin@redhat.com>
> > > 
> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > > so qemu using rbd image hang after start when run in sandbox mode.
> > > 
> > > To allow using rbd images in sandbox mode we have to whitelist it.
> > > 
> > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> > 
> > Thanks.
> > 
> > Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
> 
> Also: I'll change the subject of this email a little bit for a cleaner
> and more explicit commit.
> 
> Thanks.

Ok, thanks.

Mirek
> 
> > 
> > > ---
> > >  qemu-seccomp.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > > index 2866e3c..e29fca1 100644
> > > --- a/qemu-seccomp.c
> > > +++ b/qemu-seccomp.c
> > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > > seccomp_whitelist[] = {
> > >  #ifdef HAVE_CACHEFLUSH
> > >      { SCMP_SYS(cacheflush), 240 },
> > >  #endif
> > > +    { SCMP_SYS(sysinfo), 240 },
> > >  };
> > >  
> > >  int seccomp_start(void)
> > > --
> > > 2.5.0
> > > 
> > > 
> > 
> 
> --
> Eduardo Otubo
> ProfitBricks GmbH
> 

-- 
Miroslav Rezanina
Software Engineer - Virtualization Team