From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([2001:4830:134:3::10]:58145) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1cnkv5-00017C-E8 for qemu-devel@nongnu.org; Tue, 14 Mar 2017 07:47:16 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1cnkv4-0008E4-Bb for qemu-devel@nongnu.org; Tue, 14 Mar 2017 07:47:15 -0400 Received: from mx1.redhat.com ([209.132.183.28]:59846) by eggs.gnu.org with esmtps (TLS1.0:DHE_RSA_AES_256_CBC_SHA1:32) (Exim 4.71) (envelope-from ) id 1cnkv4-0008DT-2L for qemu-devel@nongnu.org; Tue, 14 Mar 2017 07:47:14 -0400 References: <20170314113209.12025-1-eduardo.otubo@profitbricks.com> <20170314113209.12025-4-eduardo.otubo@profitbricks.com> From: Paolo Bonzini Message-ID: Date: Tue, 14 Mar 2017 12:47:10 +0100 MIME-Version: 1.0 In-Reply-To: <20170314113209.12025-4-eduardo.otubo@profitbricks.com> Content-Type: text/plain; charset=utf-8 Content-Transfer-Encoding: 7bit Subject: Re: [Qemu-devel] [PATCH 3/5] seccomp: add elevateprivileges argument to command line List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo , qemu-devel@nongnu.org Cc: thuth@redhat.com On 14/03/2017 12:32, Eduardo Otubo wrote: > This patch introduces the new argument [,elevateprivileges=deny] to the > `-sandbox on'. It avoids Qemu process to elevate its privileges by > blacklisting all set*uid|gid system calls > > Signed-off-by: Eduardo Otubo > --- > include/sysemu/seccomp.h | 1 + > qemu-options.hx | 8 ++++++-- > qemu-seccomp.c | 28 ++++++++++++++++++++++++++++ > vl.c | 11 +++++++++++ > 4 files changed, 46 insertions(+), 2 deletions(-) > > diff --git a/include/sysemu/seccomp.h b/include/sysemu/seccomp.h > index 7a7bde246b..e6e78d85ce 100644 > --- a/include/sysemu/seccomp.h > +++ b/include/sysemu/seccomp.h > @@ -16,6 +16,7 @@ > #define QEMU_SECCOMP_H > > #define OBSOLETE 0x0001 > +#define PRIVILEGED 0x0010 > > #include > > diff --git a/qemu-options.hx b/qemu-options.hx > index 1403d0c85f..47018db5aa 100644 > --- a/qemu-options.hx > +++ b/qemu-options.hx > @@ -3732,8 +3732,10 @@ Old param mode (ARM only). > ETEXI > > DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \ > - "-sandbox on[,obsolete=allow] Enable seccomp mode 2 system call filter (default 'off').\n" \ > - " obsolete: Allow obsolete system calls", > + "-sandbox on[,obsolete=allow][,elevateprivileges=deny]\n" \ > + " Enable seccomp mode 2 system call filter (default 'off').\n" \ > + " obsolete: Allow obsolete system calls\n" \ > + " elevateprivileges: avoids Qemu process to elevate its privileges by blacklisting all set*uid|gid system calls", Why allow these by default? Paolo > QEMU_ARCH_ALL) > STEXI > @item -sandbox @var{arg}[,obsolete=@var{string}] > @@ -3743,6 +3745,8 @@ disable it. The default is 'off'. > @table @option > @item obsolete=@var{string} > Enable Obsolete system calls > +@item elevateprivileges=@var{string} > +Disable set*uid|gid systema calls > @end table > ETEXI > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 5ef36890da..5aa6590386 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -31,6 +31,19 @@ struct QemuSeccompSyscall { > uint8_t priority; > }; > > +static const struct QemuSeccompSyscall privileged_syscalls[] = { > + { SCMP_SYS(setuid), 255 }, > + { SCMP_SYS(setgid), 255 }, > + { SCMP_SYS(setpgid), 255 }, > + { SCMP_SYS(setsid), 255 }, > + { SCMP_SYS(setreuid), 255 }, > + { SCMP_SYS(setregid), 255 }, > + { SCMP_SYS(setresuid), 255 }, > + { SCMP_SYS(setresgid), 255 }, > + { SCMP_SYS(setfsuid), 255 }, > + { SCMP_SYS(setfsgid), 255 }, > +}; > + > static const struct QemuSeccompSyscall obsolete[] = { > { SCMP_SYS(readdir), 255 }, > { SCMP_SYS(_sysctl), 255 }, > @@ -125,6 +138,21 @@ int seccomp_start(uint8_t seccomp_opts) > } > } > > + if (seccomp_opts & PRIVILEGED) { > + for (i = 0; i < ARRAY_SIZE(privileged_syscalls); i++) { > + rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, privileged_syscalls[i].num, 0); > + if (rc < 0) { > + goto seccomp_return; > + } > + rc = seccomp_syscall_priority(ctx, privileged_syscalls[i].num, > + privileged_syscalls[i].priority); > + if (rc < 0) { > + goto seccomp_return; > + } > + } > + } > + > + > rc = seccomp_load(ctx); > > seccomp_return: > diff --git a/vl.c b/vl.c > index 7b08b3383b..d071e240b0 100644 > --- a/vl.c > +++ b/vl.c > @@ -273,6 +273,10 @@ static QemuOptsList qemu_sandbox_opts = { > .name = "obsolete", > .type = QEMU_OPT_STRING, > }, > + { > + .name = "elevateprivileges", > + .type = QEMU_OPT_STRING, > + }, > { /* end of list */ } > }, > }; > @@ -1045,6 +1049,13 @@ static int parse_sandbox(void *opaque, QemuOpts *opts, Error **errp) > } > } > > + value = qemu_opt_get(opts,"elevateprivileges"); > + if (value) { > + if (strcmp(value, "deny") == 0) { > + seccomp_opts |= PRIVILEGED; > + } > + } > + > if (seccomp_start(seccomp_opts) < 0) { > error_report("failed to install seccomp syscall filter " > "in the kernel"); >