Re: [Qemu-devel] [PATCH] seccomp: add timerfd_create and timerfd_settime to the whitelist

[Eduardo Otubo]

On 01/28/2014 04:03 PM, Felix Geyer wrote:
> On 28.01.2014 14:00, Eduardo Otubo wrote:
> > On 01/26/2014 10:21 AM, Felix Geyer wrote:
> > > libusb calls timerfd_create() and timerfd_settime() when it's built with
> > > timerfd support.
> > >
> > > Command to reproduce:
> > >
> > > qemu -sandbox on -monitor stdio -device piix3-usb-uhci,id=usb
> > >        -device usb-host,hostbus=1,hostaddr=3,id=hostdev0
> > >
> > > Log messages:
> > >
> > > audit(1390730418.924:135): auid=4294967295 uid=121 gid=103 ses=4294967295
> > >                              pid=5232 comm="qemu-system-x86" sig=31 syscall=283
> > >                              compat=0 ip=0x7f2b0f4e96a7 code=0x0
> > > audit(1390733100.580:142): auid=4294967295 uid=121 gid=103 ses=4294967295
> > >                              pid=16909 comm="qemu-system-x86" sig=31 syscall=286
> > >                              compat=0 ip=0x7f03513a06da code=0x0
> > >
> > > Signed-off-by: Felix Geyer <address@hidden>
> > > ---
> > >    qemu-seccomp.c | 4 +++-
> > >    1 file changed, 3 insertions(+), 1 deletion(-)
> > >
> > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > > index caa926e..2705468 100644
> > > --- a/qemu-seccomp.c
> > > +++ b/qemu-seccomp.c
> > > @@ -225,7 +225,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] 
> > > = {
> > >        { SCMP_SYS(fchmod), 240 },
> > >        { SCMP_SYS(shmget), 240 },
> > >        { SCMP_SYS(shmat), 240 },
> > > -    { SCMP_SYS(shmdt), 240 }
> > > +    { SCMP_SYS(shmdt), 240 },
> > > +    { SCMP_SYS(timerfd_create), 240 },
> > > +    { SCMP_SYS(timerfd_settime), 240 }
> >
> > Did you deliberately set the priority to 240? Or did you run any sort of 
> > benchmark (strace) to
> > find this value?
> >
> > Regards,
>
> Not really, sorry.
>
> I've now done a benchmark on x86_64, copying a few hundred MB from a USB drive:
>
>      calls  syscall
>   --------- ----------------
>     5303600 write
>     2240554 read
>     2167030 ppoll
>     2134828 ioctl
>      704023 timerfd_settime
>      689105 poll
>       83122 futex
>         803 writev
>         476 rt_sigprocmask
>         287 recvmsg
>         178 brk
>
> timerfd_create is basically only called once so it can have the lowest priority.
> timerfd_settime should probably have priority around 242.

Fair enough. Please send another patch fixing the priority values and 
I'll ACK. I usually send pull requests at Friday EOD. So if you need 
anything to be pull-requested until this Friday, please send so we can 
discuss and ACK until there.

Thanks for the contribution :)

--
Eduardo Otubo
IBM Linux Technology Center