From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:56132) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SeuJx-0007Pa-9P for qemu-devel@nongnu.org; Wed, 13 Jun 2012 16:37:43 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SeuJu-0002Tv-5o for qemu-devel@nongnu.org; Wed, 13 Jun 2012 16:37:40 -0400 Received: from mx1.redhat.com ([209.132.183.28]:15230) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SeuJt-0002Ta-UH for qemu-devel@nongnu.org; Wed, 13 Jun 2012 16:37:38 -0400 Date: Wed, 13 Jun 2012 21:37:31 +0100 From: "Daniel P. Berrange" Message-ID: <20120613203731.GD6019@redhat.com> References: MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Subject: Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to libseccomp in vl.c Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Eduardo Otubo Cc: qemu-devel@nongnu.org On Wed, Jun 13, 2012 at 04:20:22PM -0300, Eduardo Otubo wrote: > I added a syscall struct using priority levels as described in the > libseccomp man page. The priority numbers are based to the frequency > they appear in a sample strace from a regular qemu guest run under > libvirt. > > Libseccomp generates linear BPF code to filter system calls, those rules > are read one after another. The priority system places the most common > rules first in order to reduce the overhead when processing them. > > Also, since this is just a first RFC, the whitelist is a little raw. We > might need your help to improve, test and fine tune the set of system > calls. > > v2: Fixed some style issues > Removed code from vl.c and created qemu-seccomp.[ch] > Now using ARRAY_SIZE macro > Added more syscalls without priority/frequency set yet > > +static struct QemuSeccompSyscall seccomp_whitelist[] = { > + { SCMP_SYS(timer_settime), 255 }, > + { SCMP_SYS(timer_gettime), 254 }, > + { SCMP_SYS(futex), 253 }, > + { SCMP_SYS(select), 252 }, > + { SCMP_SYS(recvfrom), 251 }, > + { SCMP_SYS(sendto), 250 }, > + { SCMP_SYS(read), 249 }, > + { SCMP_SYS(brk), 248 }, > + { SCMP_SYS(clone), 247 }, > + { SCMP_SYS(mmap), 247 }, > + { SCMP_SYS(mprotect), 246 }, > + { SCMP_SYS(ioctl), 245 }, > + { SCMP_SYS(recvmsg), 245 }, > + { SCMP_SYS(sendmsg), 245 }, > + { SCMP_SYS(accept), 245 }, > + { SCMP_SYS(connect), 245 }, > + { SCMP_SYS(bind), 245 }, > + { SCMP_SYS(listen), 245 }, > + { SCMP_SYS(ioctl), 245 }, > + { SCMP_SYS(eventfd), 245 }, > + { SCMP_SYS(rt_sigprocmask), 245 }, > + { SCMP_SYS(write), 244 }, > + { SCMP_SYS(fcntl), 243 }, > + { SCMP_SYS(tgkill), 242 }, > + { SCMP_SYS(rt_sigaction), 242 }, > + { SCMP_SYS(pipe2), 242 }, > + { SCMP_SYS(munmap), 242 }, > + { SCMP_SYS(mremap), 242 }, > + { SCMP_SYS(getsockname), 242 }, > + { SCMP_SYS(getpeername), 242 }, > + { SCMP_SYS(fdatasync), 242 }, > + { SCMP_SYS(close), 242 } > +}; Hmm, this is still missing the 'open' syscall. How does QEMU work at all with these patches applied, without this syscall listed ? Daniel -- |: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :| |: http://libvirt.org -o- http://virt-manager.org :| |: http://autobuild.org -o- http://search.cpan.org/~danberr/ :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|