[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for

From: Eduardo Otubo
Subject: Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist
Date: Tue, 17 Sep 2013 15:08:18 -0300
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130621 Thunderbird/17.0.7

On 09/17/2013 02:14 PM, Eduardo Otubo wrote:

On 09/17/2013 11:43 AM, Paul Moore wrote:
On Tuesday, September 17, 2013 02:06:06 PM Daniel P. Berrange wrote:
On Tue, Sep 17, 2013 at 10:01:23AM -0300, Eduardo Otubo wrote:

Paul, what exactly are you planning to add to libvirt? I'm not a big
fan of using qemu command line to pass syscalls for blacklist as
arguments, but I can't see other way to avoid problems (like -net
bridge / -net tap) from happening.

At present, and as far as I'm concerned pretty much everything is open
discussion, the code works similar to the libvirt network filters.
You create
a separate XML configuration file which defines the filter and you
that filter from the domain's XML configuration.  When a QEMU/KVM or
LXC based
domain starts it uses libseccomp to create the seccomp filter and then
it into the kernel after the fork but before the domain is exec'd.

Clever approach. I tihnk a possible way to do this is something like:



[,whitelist=qemu_whitelist.conf] will override default whitelist filter
[,blacklist=blacklist.conf] will override default blacklist filter

But when we add seccomp support for qemu on libvirt, we make sure to
just add -sandbox off and use Paul's approach.

Is that a reasonable approach? What do you think?

This approach is also interesting from the test point of view. I'll be able to write more complex tests on virt-test. General tests like "remove one syscall at a time from whitelist and test" --without the need of sed'ing the code and recompiling every time, or even include new syscalls to the blacklist.

There are no command line arguments passed to QEMU.  This work can
with the QEMU seccomp filters without problem.

The original goal of this effort wasn't to add libvirt syscall
filtering for
QEMU, but rather for LXC; adding QEMU support just happened to be a
patch once the LXC support was added.

(I also apologize for the delays, I hit a snag with an existing
problem on
libvirt which stopped work and then some other BZs grabbed my

IMHO, if libvirt is enabling seccomp, then making all possible cli
args work is a non-goal. If there are things which require privileges
seccomp is blocking, then libvirt should avoid using them. eg by making
use of FD passing where appropriate to reduce privileges qemu needs.

I agree.

Eduardo Otubo
IBM Linux Technology Center

reply via email to

[Prev in Thread] Current Thread [Next in Thread]