From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:40397) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SgXHw-0003EX-Oj for qemu-devel@nongnu.org; Mon, 18 Jun 2012 04:26:22 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SgXHn-0001zv-85 for qemu-devel@nongnu.org; Mon, 18 Jun 2012 04:26:20 -0400 Received: from mx1.redhat.com ([209.132.183.28]:37204) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SgXHm-0001zl-WB for qemu-devel@nongnu.org; Mon, 18 Jun 2012 04:26:11 -0400 Date: Mon, 18 Jun 2012 09:26:03 +0100 From: "Daniel P. Berrange" Message-ID: <20120618082603.GB28026@redhat.com> References: <20120613203028.GB6019@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to libseccomp in vl.c Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Blue Swirl Cc: qemu-devel@nongnu.org, Eduardo Otubo On Fri, Jun 15, 2012 at 07:06:10PM +0000, Blue Swirl wrote: > On Wed, Jun 13, 2012 at 8:30 PM, Daniel P. Berrange wrote: > > On Wed, Jun 13, 2012 at 04:20:22PM -0300, Eduardo Otubo wrote: > >> I added a syscall struct using priority levels as described in the > >> libseccomp man page. The priority numbers are based to the frequency > >> they appear in a sample strace from a regular qemu guest run under > >> libvirt. > >> > >> Libseccomp generates linear BPF code to filter system calls, those r= ules > >> are read one after another. The priority system places the most comm= on > >> rules first in order to reduce the overhead when processing them. > >> > >> Also, since this is just a first RFC, the whitelist is a little raw.= We > >> might need your help to improve, test and fine tune the set of syste= m > >> calls. > >> > >> v2: Fixed some style issues > >> =C2=A0 =C2=A0 =C2=A0 Removed code from vl.c and created qemu-seccomp= .[ch] > >> =C2=A0 =C2=A0 =C2=A0 Now using ARRAY_SIZE macro > >> =C2=A0 =C2=A0 =C2=A0 Added more syscalls without priority/frequency = set yet > >> > >> Signed-off-by: Eduardo Otubo > >> --- > >> =C2=A0qemu-seccomp.c | =C2=A0 73 +++++++++++++++++++++++++++++++++++= +++++++++++++++++++++ > >> =C2=A0qemu-seccomp.h | =C2=A0 =C2=A09 +++++++ > >> =C2=A0vl.c =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 | =C2=A0 =C2=A07 +++++= + > >> =C2=A03 files changed, 89 insertions(+) > >> =C2=A0create mode 100644 qemu-seccomp.c > >> =C2=A0create mode 100644 qemu-seccomp.h > >> > >> diff --git a/qemu-seccomp.c b/qemu-seccomp.c > >> new file mode 100644 > >> index 0000000..048b7ba > >> --- /dev/null > >> +++ b/qemu-seccomp.c > >> @@ -0,0 +1,73 @@ > >> +#include > >> +#include > >> +#include "qemu-seccomp.h" > >> + > >> +static struct QemuSeccompSyscall seccomp_whitelist[] =3D { > >> + =C2=A0 =C2=A0{ SCMP_SYS(timer_settime), 255 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(timer_gettime), 254 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(futex), 253 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(select), 252 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(recvfrom), 251 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(sendto), 250 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(read), 249 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(brk), 248 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(clone), 247 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(mmap), 247 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(mprotect), 246 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(ioctl), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(recvmsg), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(sendmsg), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(accept), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(connect), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(bind), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(listen), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(ioctl), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(eventfd), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(rt_sigprocmask), 245 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(write), 244 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(fcntl), 243 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(tgkill), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(rt_sigaction), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(pipe2), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(munmap), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(mremap), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(getsockname), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(getpeername), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(fdatasync), 242 }, > >> + =C2=A0 =C2=A0{ SCMP_SYS(close), 242 } > > > > execve(), so QEMU can run things like the ifup/down > > scripts, the samba daemon (sic), exec: migration protocol, > > etc, etc >=20 > I think allowing execve() would render seccomp pretty much useless. So do I, but in the previous posting it was stated[1] that the intent is to allow all syscalls QEMU needs, and not have any loss of current functionality. Hence I'm reporting all syscalls that are missing that QEMU needs. Daniel [1] https://lists.gnu.org/archive/html/qemu-devel/2012-05/msg00928.html --=20 |: http://berrange.com -o- http://www.flickr.com/photos/dberrange= / :| |: http://libvirt.org -o- http://virt-manager.or= g :| |: http://autobuild.org -o- http://search.cpan.org/~danberr= / :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vn= c :|