From patchwork Thu Oct 15 07:57:59 2015 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eduardo Otubo X-Patchwork-Id: 530556 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id A49DF1402BC for ; Thu, 15 Oct 2015 19:02:57 +1100 (AEDT) Received: from localhost ([::1]:46372 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmdV0-0007XQ-SE for incoming@patchwork.ozlabs.org; Thu, 15 Oct 2015 04:02:55 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:35850) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmdQb-0001AH-Ht for qemu-devel@nongnu.org; Thu, 15 Oct 2015 03:58:23 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1ZmdQW-0004xn-85 for qemu-devel@nongnu.org; Thu, 15 Oct 2015 03:58:21 -0400 Received: from mail-wi0-f172.google.com ([209.85.212.172]:33244) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1ZmdQW-0004xi-19 for qemu-devel@nongnu.org; Thu, 15 Oct 2015 03:58:16 -0400 Received: by wijp11 with SMTP id p11so16380831wij.0 for ; Thu, 15 Oct 2015 00:58:15 -0700 (PDT) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references; bh=655IpPkIxtoM1lNmvGfzQf8AdYo0tV2oUUDqvSV7BQI=; b=ZvAKZ60viscm/BjAJTlBTxyw7QasikLlOL/mPRQfhmqRIAsWr0pe7y1jLKi/AbBoOf gZVYJBgZcbvDV7CGTvApD508dIRo45io1XbH+mi7cwVNYyASI7ZJkbCwTqHyBDRqSBpW IGXYXZkSoGaNsYnXVZj8XtWf6JUbDOYVNx52BBZI61sNAjhem3COHT+xH3ur5DEOEjvc KLNPju2PAY011v13Gxk4X4qQjnOx0I9bIR1q7hcJLFQowwj4v+T3PXX3tFAa48pYC192 SyUQ3WA+b4BEaHDPl9A9YNIIGgBBg50e6Tq0CpYOXp12In+oFCAyJD/gPMIzpVnrtJV6 g8yA== X-Gm-Message-State: ALoCoQmsjF05ACNHB9jndXHobR9lMoq0jkSFKo0FfY9ofzdAMJhOS9A4e6b7zhFWy7H4FPMQmC6Q X-Received: by 10.194.84.42 with SMTP id v10mr9937436wjy.1.1444895895461; Thu, 15 Oct 2015 00:58:15 -0700 (PDT) Received: from vader.pb.local ([62.217.45.26]) by smtp.gmail.com with ESMTPSA id gl7sm2821418wib.1.2015.10.15.00.58.14 (version=TLS1_2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Thu, 15 Oct 2015 00:58:14 -0700 (PDT) From: Eduardo Otubo To: qemu-devel@nongnu.org Date: Thu, 15 Oct 2015 09:57:59 +0200 Message-Id: <1444895880-27681-4-git-send-email-eduardo.otubo@profitbricks.com> X-Mailer: git-send-email 2.1.4 In-Reply-To: <1444895880-27681-1-git-send-email-eduardo.otubo@profitbricks.com> References: <1444895880-27681-1-git-send-email-eduardo.otubo@profitbricks.com> X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.85.212.172 Cc: Namsun Ch'o , peter.maydell@linaro.org, drjones@redhat.com Subject: [Qemu-devel] [PULL 03/04] Add argument filters to the seccomp sandbox X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Namsun Ch'o Here's the v3 patch. I applied it and compiled QEMU, and it worked fine. Changes so far: v1 - Created argument filters for the madvise, shmget, and shmctl syscalls. v1 -> v2 - Added 5 new madvise flags which were present in the source code but not in the strace which I generated. - Added IP_CREAT|0600 to shmget, which Daniel Berrange pointed out was present in GTK2, which QEMU uses but does not call directly. v2 -> v3 - Replaced include asm/mman-common.h with sys/mman.h which is more proper. - Fixed a stupid typo where I had IP_CREAT instead of IPC_CREAT. - Removed the comma on the last entry of the madvise_flags array. - Removed one madvise flag (MADV_INVALID) which doesn't exist, apparently. Signed-off-by: Namsun Ch'o Acked-by: Eduardo Otubo --- qemu-seccomp.c | 58 +++++++++++++++++++++++++++++++++++++++++++++++++++++++--- 1 file changed, 55 insertions(+), 3 deletions(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 33644a4..e7a54e8 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -14,6 +14,8 @@ */ #include #include +#include +#include #include "sysemu/seccomp.h" struct QemuSeccompSyscall { @@ -105,7 +107,6 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(rt_sigreturn), 245 }, { SCMP_SYS(sync), 245 }, { SCMP_SYS(pread64), 245 }, - { SCMP_SYS(madvise), 245 }, { SCMP_SYS(set_robust_list), 245 }, { SCMP_SYS(lseek), 245 }, { SCMP_SYS(pselect6), 245 }, @@ -224,11 +225,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(arch_prctl), 240 }, { SCMP_SYS(mkdir), 240 }, { SCMP_SYS(fchmod), 240 }, - { SCMP_SYS(shmget), 240 }, { SCMP_SYS(shmat), 240 }, { SCMP_SYS(shmdt), 240 }, { SCMP_SYS(timerfd_create), 240 }, - { SCMP_SYS(shmctl), 240 }, { SCMP_SYS(mlockall), 240 }, { SCMP_SYS(mlock), 240 }, { SCMP_SYS(munlock), 240 }, @@ -265,6 +264,59 @@ int seccomp_start(void) } } + /* madvise */ + static const int madvise_flags[] = { + MADV_DODUMP, + MADV_DONTDUMP, + MADV_UNMERGEABLE, + MADV_WILLNEED, + MADV_DONTFORK, + MADV_DONTNEED, + MADV_HUGEPAGE, + MADV_MERGEABLE + }; + for (i = 0; i < ARRAY_SIZE(madvise_flags); i++) { + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(madvise), 1, + SCMP_A2(SCMP_CMP_EQ, madvise_flags[i])); + if (rc < 0) { + goto seccomp_return; + } + } + rc = seccomp_syscall_priority(ctx, SCMP_SYS(madvise), 245); + if (rc < 0) { + goto seccomp_return; + } + + /* shmget */ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2, + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE), + SCMP_A2(SCMP_CMP_EQ, IPC_CREAT|0777)); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2, + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE), + SCMP_A2(SCMP_CMP_EQ, IPC_CREAT|0600)); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_syscall_priority(ctx, SCMP_SYS(shmget), 240); + if (rc < 0) { + goto seccomp_return; + } + + /* shmctl */ + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmctl), 2, + SCMP_A1(SCMP_CMP_EQ, IPC_RMID), + SCMP_A2(SCMP_CMP_EQ, 0)); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_syscall_priority(ctx, SCMP_SYS(shmctl), 240); + if (rc < 0) { + goto seccomp_return; + } + rc = seccomp_load(ctx); seccomp_return: