[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH 2/5] seccomp: add obsolete argument to command l
From: |
Eduardo Otubo |
Subject: |
Re: [Qemu-devel] [PATCH 2/5] seccomp: add obsolete argument to command line |
Date: |
Tue, 14 Mar 2017 13:22:00 +0100 |
User-agent: |
Mutt/1.5.24 (2015-08-30) |
On Tue, Mar 14, 2017 at 01=01=11PM +0100, Thomas Huth wrote:
> On 14.03.2017 12:32, Eduardo Otubo wrote:
> > This patch introduces the argument [,obsolete=allow] to the `-sandbox on'
> > option. It allows Qemu to run safely on old system that still relies on
> > old system calls.
> >
> > Signed-off-by: Eduardo Otubo <address@hidden>
> > ---
> > include/sysemu/seccomp.h | 4 +++-
> > qemu-options.hx | 9 +++++++--
> > qemu-seccomp.c | 47
> > ++++++++++++++++++++++++++++++++++++++++++++++-
> > vl.c | 16 +++++++++++++++-
> > 4 files changed, 71 insertions(+), 5 deletions(-)
> >
> > diff --git a/include/sysemu/seccomp.h b/include/sysemu/seccomp.h
> > index cfc06008cb..7a7bde246b 100644
> > --- a/include/sysemu/seccomp.h
> > +++ b/include/sysemu/seccomp.h
> > @@ -15,7 +15,9 @@
> > #ifndef QEMU_SECCOMP_H
> > #define QEMU_SECCOMP_H
> >
> > +#define OBSOLETE 0x0001
> > +
> > #include <seccomp.h>
> >
> > -int seccomp_start(void);
> > +int seccomp_start(uint8_t seccomp_opts);
> > #endif
> > diff --git a/qemu-options.hx b/qemu-options.hx
> > index 8dd8ee34a6..1403d0c85f 100644
> > --- a/qemu-options.hx
> > +++ b/qemu-options.hx
> > @@ -3732,13 +3732,18 @@ Old param mode (ARM only).
> > ETEXI
> >
> > DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
> > - "-sandbox <arg> Enable seccomp mode 2 system call filter (default
> > 'off').\n",
> > + "-sandbox on[,obsolete=allow] Enable seccomp mode 2 system call
> > filter (default 'off').\n" \
> > + " obsolete: Allow obsolete system calls",
> > QEMU_ARCH_ALL)
> > STEXI
> > address@hidden -sandbox @var{arg}
> > address@hidden -sandbox @var{arg}[,address@hidden
> > @findex -sandbox
> > Enable Seccomp mode 2 system call filter. 'on' will enable syscall
> > filtering and 'off' will
> > disable it. The default is 'off'.
> > address@hidden @option
> > address@hidden address@hidden
> > +Enable Obsolete system calls
> > address@hidden table
> > ETEXI
> >
> > DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig,
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index f8877b07b5..5ef36890da 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -31,6 +31,35 @@ struct QemuSeccompSyscall {
> > uint8_t priority;
> > };
> >
> > +static const struct QemuSeccompSyscall obsolete[] = {
> > + { SCMP_SYS(readdir), 255 },
> > + { SCMP_SYS(_sysctl), 255 },
> > + { SCMP_SYS(afs_syscall), 255 },
> > + { SCMP_SYS(bdflush), 255 },
> > + { SCMP_SYS(break), 255 },
> > + { SCMP_SYS(create_module), 255 },
> > + { SCMP_SYS(ftime), 255 },
> > + { SCMP_SYS(get_kernel_syms), 255 },
> > + { SCMP_SYS(getpmsg), 255 },
> > + { SCMP_SYS(gtty), 255 },
> > + { SCMP_SYS(lock), 255 },
> > + { SCMP_SYS(mpx), 255 },
> > + { SCMP_SYS(prof), 255 },
> > + { SCMP_SYS(profil), 255 },
> > + { SCMP_SYS(putpmsg), 255 },
> > + { SCMP_SYS(query_module), 255 },
> > + { SCMP_SYS(security), 255 },
> > + { SCMP_SYS(sgetmask), 255 },
> > + { SCMP_SYS(ssetmask), 255 },
> > + { SCMP_SYS(stty), 255 },
> > + { SCMP_SYS(sysfs), 255 },
> > + { SCMP_SYS(tuxcall), 255 },
> > + { SCMP_SYS(ulimit), 255 },
> > + { SCMP_SYS(uselib), 255 },
> > + { SCMP_SYS(ustat), 255 },
> > + { SCMP_SYS(vserver), 255 },
> > +};
> > +
> > static const struct QemuSeccompSyscall blacklist[] = {
> > { SCMP_SYS(reboot), 255 },
> > { SCMP_SYS(swapon), 255 },
> > @@ -56,7 +85,20 @@ static const struct QemuSeccompSyscall blacklist[] = {
> > { SCMP_SYS(vserver), 255 },
> > };
> >
> > -int seccomp_start(void)
> > +static int is_obsolete(int syscall)
> > +{
> > + unsigned int i = 0;
> > +
> > + for (i = 0; i < ARRAY_SIZE(obsolete); i++) {
> > + if (syscall == obsolete[i].num) {
> > + return 1;
> > + }
> > + }
> > +
> > + return 0;
> > +}
> > +
> > +int seccomp_start(uint8_t seccomp_opts)
> > {
> > int rc = 0;
> > unsigned int i = 0;
> > @@ -69,6 +111,9 @@ int seccomp_start(void)
> > }
> >
> > for (i = 0; i < ARRAY_SIZE(blacklist); i++) {
> > + if ((seccomp_opts & OBSOLETE) && is_obsolete(blacklist[i].num)) {
> > + continue;
> > + }
> > rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, blacklist[i].num, 0);
> > if (rc < 0) {
> > goto seccomp_return;
> > diff --git a/vl.c b/vl.c
> > index 1a95500ac7..7b08b3383b 100644
> > --- a/vl.c
> > +++ b/vl.c
> > @@ -269,6 +269,10 @@ static QemuOptsList qemu_sandbox_opts = {
> > .name = "enable",
> > .type = QEMU_OPT_BOOL,
> > },
> > + {
> > + .name = "obsolete",
> > + .type = QEMU_OPT_STRING,
> > + },
>
> Since this is basically a boolean switch, could you maybe rather use
> "QEMU_OPT_BOOL" here, too (and also in the following patches)? I think
> it is also easier for the users to memorize "obsolete=on" instead of
> yet-another-parameter-syntax like "obsolete=allow".
>
Yes, that's definitely in my mind. I just wanted to make the first
draft the same way Daniel designed and evolve from there.
--
Eduardo Otubo
ProfitBricks GmbH