Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist

[Eduardo Otubo]

On 09/17/2013 02:14 PM, Eduardo Otubo wrote:
> On 09/17/2013 11:43 AM, Paul Moore wrote:
> > On Tuesday, September 17, 2013 02:06:06 PM Daniel P. Berrange wrote:
> > > On Tue, Sep 17, 2013 at 10:01:23AM -0300, Eduardo Otubo wrote:
> > >
> > > > Paul, what exactly are you planning to add to libvirt? I'm not a big
> > > > fan of using qemu command line to pass syscalls for blacklist as
> > > > arguments, but I can't see other way to avoid problems (like -net
> > > > bridge / -net tap) from happening.
> >
> > At present, and as far as I'm concerned pretty much everything is open
> > for
> > discussion, the code works similar to the libvirt network filters.
> > You create
> > a separate XML configuration file which defines the filter and you
> > reference
> > that filter from the domain's XML configuration.  When a QEMU/KVM or
> > LXC based
> > domain starts it uses libseccomp to create the seccomp filter and then
> > loads
> > it into the kernel after the fork but before the domain is exec'd.
>
> Clever approach. I tihnk a possible way to do this is something like:
>
>   -sandbox
> -on[,strict=<on|off>][,whitelist=qemu_whitelist.conf][,blacklist=qemu_blacklist.conf]
>
>
>      where:
>
> [,whitelist=qemu_whitelist.conf] will override default whitelist filter
> [,blacklist=blacklist.conf] will override default blacklist filter
>
> But when we add seccomp support for qemu on libvirt, we make sure to
> just add -sandbox off and use Paul's approach.
>
> Is that a reasonable approach? What do you think?

This approach is also interesting from the test point of view. I'll be 
able to write more complex tests on virt-test. General tests like 
"remove one syscall at a time from whitelist and test" --without the 
need of sed'ing the code and recompiling every time, or even include new 
syscalls to the blacklist.

> > There are no command line arguments passed to QEMU.  This work can
> > co-exist
> > with the QEMU seccomp filters without problem.
> >
> > The original goal of this effort wasn't to add libvirt syscall
> > filtering for
> > QEMU, but rather for LXC; adding QEMU support just happened to be a
> > trivial
> > patch once the LXC support was added.
> >
> > (I also apologize for the delays, I hit a snag with an existing
> > problem on
> > libvirt which stopped work and then some other BZs grabbed my
> > attention...)
> >
> > > IMHO, if libvirt is enabling seccomp, then making all possible cli
> > > args work is a non-goal. If there are things which require privileges
> > > seccomp is blocking, then libvirt should avoid using them. eg by making
> > > use of FD passing where appropriate to reduce privileges qemu needs.
> >
> > I agree.

--
Eduardo Otubo
IBM Linux Technology Center