[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] Add a few argument filters to the seccomp sandb
From: |
Namsun Ch'o |
Subject: |
Re: [Qemu-devel] [PATCH] Add a few argument filters to the seccomp sandbox |
Date: |
Fri, 11 Sep 2015 18:45:27 -0400 |
> On Thursday, September 10, 2015 03:48:52 PM Daniel P. Berrange wrote:
> > On Wed, Sep 09, 2015 at 09:55:33PM -0400, address@hidden wrote:
> > > +
> > > + /* shmget */
> > > + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2,
> > > + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE),
> > > + SCMP_A2(SCMP_CMP_EQ, IP_CREAT|0777));
> >
> > I'm not familiar with semantics of these seccomp rules, but is this
> > saying that the second arg must be exactly equal to IP_CREAT|0777 ?
>
> Yes.
>
> > If the app passes IP_CREAT|0600, would that be permitted instead ?
> > The latter is what I see gtk2 source code passing for mode.
>
> It wouldn't match the rule as written above, if it doesn't match any other
> configured rules it would hit the default filter action.
>
> --
> paul moore
> security @ redhat
I'd already replied to that but in a new top-level thread because I had an
updated patch. Did I misunderstand the "contributing a patch" FAQ? Anyway,
I added the IP_CREAT|0600 rule to the v2 patch:
https://lists.nongnu.org/archive/html/qemu-devel/2015-09/msg02953.html