From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from eggs.gnu.org ([208.118.235.92]:35563) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SgXPB-0000LG-KF for qemu-devel@nongnu.org; Mon, 18 Jun 2012 04:33:52 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1SgXP6-0003cM-K4 for qemu-devel@nongnu.org; Mon, 18 Jun 2012 04:33:49 -0400 Received: from mx1.redhat.com ([209.132.183.28]:5360) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1SgXP6-0003bz-CT for qemu-devel@nongnu.org; Mon, 18 Jun 2012 04:33:44 -0400 Date: Mon, 18 Jun 2012 09:33:37 +0100 From: "Daniel P. Berrange" Message-ID: <20120618083335.GD28026@redhat.com> References: <20120613203305.GC6019@redhat.com> MIME-Version: 1.0 Content-Type: text/plain; charset=utf-8 Content-Disposition: inline In-Reply-To: Content-Transfer-Encoding: quoted-printable Subject: Re: [Qemu-devel] [RFC] [PATCHv2 2/2] Adding basic calls to libseccomp in vl.c Reply-To: "Daniel P. Berrange" List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , To: Blue Swirl Cc: qemu-devel@nongnu.org, Eduardo Otubo On Fri, Jun 15, 2012 at 07:04:45PM +0000, Blue Swirl wrote: > On Wed, Jun 13, 2012 at 8:33 PM, Daniel P. Berrange wrote: > > On Wed, Jun 13, 2012 at 07:56:06PM +0000, Blue Swirl wrote: > >> On Wed, Jun 13, 2012 at 7:20 PM, Eduardo Otubo wrote: > >> > I added a syscall struct using priority levels as described in the > >> > libseccomp man page. The priority numbers are based to the frequen= cy > >> > they appear in a sample strace from a regular qemu guest run under > >> > libvirt. > >> > > >> > Libseccomp generates linear BPF code to filter system calls, those= rules > >> > are read one after another. The priority system places the most co= mmon > >> > rules first in order to reduce the overhead when processing them. > >> > > >> > Also, since this is just a first RFC, the whitelist is a little ra= w. We > >> > might need your help to improve, test and fine tune the set of sys= tem > >> > calls. > >> > > >> > v2: Fixed some style issues > >> > =C2=A0 =C2=A0 =C2=A0 =C2=A0Removed code from vl.c and created qemu= -seccomp.[ch] > >> > =C2=A0 =C2=A0 =C2=A0 =C2=A0Now using ARRAY_SIZE macro > >> > =C2=A0 =C2=A0 =C2=A0 =C2=A0Added more syscalls without priority/fr= equency set yet > >> > > >> > Signed-off-by: Eduardo Otubo > >> > --- > >> > =C2=A0qemu-seccomp.c | =C2=A0 73 +++++++++++++++++++++++++++++++++= +++++++++++++++++++++++ > >> > =C2=A0qemu-seccomp.h | =C2=A0 =C2=A09 +++++++ > >> > =C2=A0vl.c =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 | =C2=A0 =C2=A07 +++= +++ > >> > =C2=A03 files changed, 89 insertions(+) > >> > =C2=A0create mode 100644 qemu-seccomp.c > >> > =C2=A0create mode 100644 qemu-seccomp.h > >> > > >> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > >> > new file mode 100644 > >> > index 0000000..048b7ba > >> > --- /dev/null > >> > +++ b/qemu-seccomp.c > >> > @@ -0,0 +1,73 @@ > >> > >> Copyright and license info missing. > >> > >> > +#include > >> > +#include > >> > +#include "qemu-seccomp.h" > >> > + > >> > +static struct QemuSeccompSyscall seccomp_whitelist[] =3D { > >> > >> 'const' > >> > >> > + =C2=A0 =C2=A0{ SCMP_SYS(timer_settime), 255 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(timer_gettime), 254 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(futex), 253 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(select), 252 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(recvfrom), 251 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(sendto), 250 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(read), 249 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(brk), 248 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(clone), 247 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(mmap), 247 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(mprotect), 246 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(ioctl), 245 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(recvmsg), 245 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(sendmsg), 245 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(accept), 245 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(connect), 245 }, > >> > + =C2=A0 =C2=A0{ SCMP_SYS(bind), 245 }, > >> > >> It would be nice to avoid connect() and bind(). Perhaps seccomp init > >> should be postponed to after all sockets have been created? > > > > If you want to migrate your guest, you need to be able to > > call connect() at an arbitrary point in the QEMU process' > > lifecycle. So you can't avoid allowing connect(). Similarly > > if you want to allow hotplug of NICs (and their backends) > > then you need to have both bind() + connect() available. >=20 > That's bad. Migration could conceivably be extended to use file > descriptor passing, but hotplug is more tricky. As with execve(), i'm reporting this on the basis that on the previous patch posting I was told we must whitelist any syscalls QEMU can conceivably use to avoid any loss in functionality. Daniel --=20 |: http://berrange.com -o- http://www.flickr.com/photos/dberrange= / :| |: http://libvirt.org -o- http://virt-manager.or= g :| |: http://autobuild.org -o- http://search.cpan.org/~danberr= / :| |: http://entangle-photo.org -o- http://live.gnome.org/gtk-vn= c :|