From patchwork Wed Oct 14 09:38:25 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eduardo Otubo X-Patchwork-Id: 530099 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id D542D14029E for ; Wed, 14 Oct 2015 20:43:06 +1100 (AEDT) Received: from localhost ([::1]:41362 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmIaO-0000Ot-Rj for incoming@patchwork.ozlabs.org; Wed, 14 Oct 2015 05:43:04 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:50826) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmIWY-0005dE-2h for qemu-devel@nongnu.org; Wed, 14 Oct 2015 05:39:07 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZmIWS-0007Yv-Ry for qemu-devel@nongnu.org; Wed, 14 Oct 2015 05:39:05 -0400 Received: from mail-wi0-f174.google.com ([209.85.212.174]:33224) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmIWS-0007Yj-Lh for qemu-devel@nongnu.org; Wed, 14 Oct 2015 05:39:00 -0400 Received: by wicge5 with SMTP id ge5so92582871wic.0 for ; Wed, 14 Oct 2015 02:39:00 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=oqRIXppDGn6ka7+DPp14QgnlG7yU47iCBd7jfFJVkMk=; b=jzFgnQe8j0Slyoww9Q9oxgz9QGL8N651hqEo66aUItDftsw9Pdl2LN51CLlQ6EvNOl iXm/mS5rIwkPrupbLN+OOSKKRwiH4Lq2wCMLnVYBmQBDy3Giugy9uT0pQfxyuKqId7dl VF7hHe+K3NezXA9/RMoIhL6gzP0rHiGBu39vbhLns4RxBiQS1Su1nWJy/89/3xkjnW5S kJSINsOcO2XjWsjn3G8x7ISR42ML9npRIfUWOVgYWl1tIxqTgjocZStKKVh0UV8CSY4H pPiMV7W5nFk+ga2k2kp93td4qdH2jLem9pv+YhmOWY587XrtwmmXqXZ6WsaCYna/RUFf DR2g== X-Gm-Message-State: ALoCoQludQMNgDM8iBhWnozI5bnMQW07KkTb8IOA187B3T2rz+HAONcCAxPafMiglMW7uv5X6w8d X-Received: by 10.180.188.101 with SMTP id fz5mr3457316wic.3.1444815540059; Wed, 14 Oct 2015 02:39:00 -0700 (PDT) Received: from vader.pb.local ([62.217.45.26]) by smtp.gmail.com with ESMTPSA id xt1sm8845960wjb.32.2015.10.14.02.38.59 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Wed, 14 Oct 2015 02:38:59 -0700 (PDT) From: Eduardo Otubo To: qemu-devel@nongnu.org Date: Wed, 14 Oct 2015 11:38:25 +0200 Message-Id: <1444815506-30087-4-git-send-email-eduardo.otubo@profitbricks.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1444815506-30087-1-git-send-email-eduardo.otubo@profitbricks.com> References: <1444815506-30087-1-git-send-email-eduardo.otubo@profitbricks.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.85.212.174 Cc: Namsun Ch'o , peter.maydell@linaro.org, drjones@redhat.com Subject: [Qemu-devel] [PULL 03/04] Add argument filters to the seccomp sandbox X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Namsun Ch'o Here's the v3 patch. I applied it and compiled QEMU, and it worked fine. Changes so far: v1 - Created argument filters for the madvise, shmget, and shmctl syscalls. v1 -> v2 - Added 5 new madvise flags which were present in the source code but not in the strace which I generated. - Added IP_CREAT|0600 to shmget, which Daniel Berrange pointed out was present in GTK2, which QEMU uses but does not call directly. v2 -> v3 - Replaced include asm/mman-common.h with sys/mman.h which is more proper. - Fixed a stupid typo where I had IP_CREAT instead of IPC_CREAT. - Removed the comma on the last entry of the madvise_flags array. - Removed one madvise flag (MADV_INVALID) which doesn't exist, apparently. Signed-off-by: Namsun Ch'o Acked-by: Eduardo Otubo --- qemu-seccomp.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 55 insertions(+), 3 deletions(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 581a5e1..a54d358 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -14,6 +14,8 @@ */ #include #include +#include +#include #include "sysemu/seccomp.h" struct QemuSeccompSyscall { @@ -105,7 +107,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(rt_sigreturn), 245 }, { SCMP_SYS(sync), 245 }, { SCMP_SYS(pread64), 245 }, - { SCMP_SYS(madvise), 245 }, { SCMP_SYS(set_robust_list), 245 }, { SCMP_SYS(lseek), 245 }, { SCMP_SYS(pselect6), 245 }, @@ -224,11 +225,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(arch_prctl), 240 }, { SCMP_SYS(mkdir), 240 }, { SCMP_SYS(fchmod), 240 }, - { SCMP_SYS(shmget), 240 }, { SCMP_SYS(shmat), 240 }, { SCMP_SYS(shmdt), 240 }, { SCMP_SYS(timerfd_create), 240 }, - { SCMP_SYS(shmctl), 240 }, { SCMP_SYS(mlockall), 240 }, { SCMP_SYS(mlock), 240 }, { SCMP_SYS(munlock), 240 }, @@ -265,6 +264,59 @@ int seccomp_start(void) } } + /* madvise */ + static const int madvise_flags[] = { + MADV_DODUMP, + MADV_DONTDUMP, + MADV_UNMERGEABLE, + MADV_WILLNEED, + MADV_DONTFORK, + MADV_DONTNEED, + MADV_HUGEPAGE, + MADV_MERGEABLE + }; + for (i = 0; i < ARRAY_SIZE(madvise_flags); i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(madvise), 1, + SCMP_A2(SCMP_CMP_EQ, madvise_flags[i])); + if (rc < 0) { + goto seccomp_return; + } + } + rc = seccomp_syscall_priority(ctx, SCMP_SYS(madvise), 245); + if (rc < 0) { + goto seccomp_return; + } + + /* shmget */ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2, + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE), + SCMP_A2(SCMP_CMP_EQ, IPC_CREAT|0777)); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2, + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE), + SCMP_A2(SCMP_CMP_EQ, IPC_CREAT|0600)); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_syscall_priority(ctx, SCMP_SYS(shmget), 240); + if (rc < 0) { + goto seccomp_return; + } + + /* shmctl */ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmctl), 2, + SCMP_A1(SCMP_CMP_EQ, IPC_RMID), + SCMP_A2(SCMP_CMP_EQ, 0)); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_syscall_priority(ctx, SCMP_SYS(shmctl), 240); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_load(ctx); seccomp_return: