[Top][All Lists]
[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCHv3 4/5] seccomp: double whitelist support
From: |
Eduardo Otubo |
Subject: |
[Qemu-devel] [PATCHv3 4/5] seccomp: double whitelist support |
Date: |
Mon, 12 Nov 2012 17:48:17 -0200 |
This patch includes a second whitelist right before the main loop. The
second whitelist is more restricted and does not contain execve().
Although it works fine the way it is now, it's optimal to update and
fine tune it.
v2: * ctx changed to main_loop_ctx
* seccomp_on now inside ifdef
* open() syscall added to the main_loop whitelist
v3: * Main loop now has whitelist without execve().
* Use enum seccomp_states, seccomp_get_state(), and
seccomp_install_filter()
* Added new syscalls with priority 241 that are unknown to be
used by QEMU. We'll attempt to remove these after QEMU 1.3.
Signed-off-by: Eduardo Otubo <address@hidden>
Signed-off-by: Corey Bryant <address@hidden>
---
qemu-seccomp.c | 252 +++++++++++++++++++++++++++++++++++++++++++++++++++++---
qemu-seccomp.h | 2 +-
vl.c | 9 +-
3 files changed, 251 insertions(+), 12 deletions(-)
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 2386996..d5a3b0f 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -13,9 +13,9 @@
* GNU GPL, version 2 or (at your option) any later version.
*/
#include "config-host.h"
-#include <stdio.h>
#include "osdep.h"
#include "qemu-seccomp.h"
+#include <stdio.h>
#ifdef CONFIG_SECCOMP
int seccomp_state = SECCOMP_ON;
@@ -39,7 +39,7 @@ struct QemuSeccompSyscall {
uint8_t priority;
};
-static const struct QemuSeccompSyscall seccomp_whitelist[] = {
+static const struct QemuSeccompSyscall whitelist_init[] = {
{ SCMP_SYS(timer_settime), 255 },
{ SCMP_SYS(timer_gettime), 254 },
{ SCMP_SYS(futex), 253 },
@@ -241,14 +241,238 @@ static const struct QemuSeccompSyscall
seccomp_whitelist[] = {
{ SCMP_SYS(prlimit64), 241 },
{ SCMP_SYS(waitid), 241 }
};
+
+static const struct QemuSeccompSyscall whitelist_main[] = {
+ { SCMP_SYS(timer_settime), 255 },
+ { SCMP_SYS(timer_gettime), 254 },
+ { SCMP_SYS(futex), 253 },
+ { SCMP_SYS(select), 252 },
+#if defined(__x86_64__)
+ { SCMP_SYS(recvfrom), 251 },
+ { SCMP_SYS(sendto), 250 },
+#elif defined(__i386__)
+ { SCMP_SYS(socketcall), 250 },
+#endif
+ { SCMP_SYS(read), 249 },
+ { SCMP_SYS(brk), 248 },
+ { SCMP_SYS(clone), 247 },
+ { SCMP_SYS(mmap), 247 },
+ { SCMP_SYS(mprotect), 246 },
+ { SCMP_SYS(open), 245 },
+ { SCMP_SYS(ioctl), 245 },
+#if defined(__x86_64__)
+ { SCMP_SYS(socket), 245 },
+ { SCMP_SYS(setsockopt), 245 },
+ { SCMP_SYS(recvmsg), 245 },
+ { SCMP_SYS(sendmsg), 245 },
+ { SCMP_SYS(accept), 245 },
+ { SCMP_SYS(connect), 245 },
+ { SCMP_SYS(socketpair), 245 },
+ { SCMP_SYS(bind), 245 },
+ { SCMP_SYS(listen), 245 },
+ { SCMP_SYS(semget), 245 },
+#elif defined(__i386__)
+ { SCMP_SYS(ipc), 245 },
+#endif
+ { SCMP_SYS(gettimeofday), 245 },
+ { SCMP_SYS(readlink), 245 },
+ { SCMP_SYS(access), 245 },
+ { SCMP_SYS(prctl), 245 },
+ { SCMP_SYS(signalfd), 245 },
+ { SCMP_SYS(getrlimit), 245 },
+ { SCMP_SYS(set_tid_address), 245 },
+ { SCMP_SYS(statfs), 245 },
+ { SCMP_SYS(unlink), 245 },
+ { SCMP_SYS(wait4), 245 },
+#if defined(__i386__)
+ { SCMP_SYS(fcntl64), 245 },
+ { SCMP_SYS(fstat64), 245 },
+ { SCMP_SYS(stat64), 245 },
+ { SCMP_SYS(getgid32), 245 },
+ { SCMP_SYS(getegid32), 245 },
+ { SCMP_SYS(getuid32), 245 },
+ { SCMP_SYS(geteuid32), 245 },
+ { SCMP_SYS(sigreturn), 245 },
+ { SCMP_SYS(_newselect), 245 },
+ { SCMP_SYS(_llseek), 245 },
+ { SCMP_SYS(mmap2), 245 },
+ { SCMP_SYS(sigprocmask), 245 },
+#endif
+ { SCMP_SYS(sched_getparam), 245 },
+ { SCMP_SYS(sched_getscheduler), 245 },
+ { SCMP_SYS(fstat), 245 },
+ { SCMP_SYS(clock_getres), 245 },
+ { SCMP_SYS(sched_get_priority_min), 245 },
+ { SCMP_SYS(sched_get_priority_max), 245 },
+ { SCMP_SYS(stat), 245 },
+ { SCMP_SYS(uname), 245 },
+ { SCMP_SYS(eventfd2), 245 },
+ { SCMP_SYS(dup), 245 },
+ { SCMP_SYS(dup2), 245 },
+ { SCMP_SYS(dup3), 245 },
+ { SCMP_SYS(gettid), 245 },
+ { SCMP_SYS(getgid), 245 },
+ { SCMP_SYS(getegid), 245 },
+ { SCMP_SYS(getuid), 245 },
+ { SCMP_SYS(geteuid), 245 },
+ { SCMP_SYS(timer_create), 245 },
+ { SCMP_SYS(exit), 245 },
+ { SCMP_SYS(clock_gettime), 245 },
+ { SCMP_SYS(time), 245 },
+ { SCMP_SYS(restart_syscall), 245 },
+ { SCMP_SYS(pwrite64), 245 },
+ { SCMP_SYS(chown), 245 },
+ { SCMP_SYS(openat), 245 },
+ { SCMP_SYS(getdents), 245 },
+ { SCMP_SYS(timer_delete), 245 },
+ { SCMP_SYS(exit_group), 245 },
+ { SCMP_SYS(rt_sigreturn), 245 },
+ { SCMP_SYS(sync), 245 },
+ { SCMP_SYS(pread64), 245 },
+ { SCMP_SYS(madvise), 245 },
+ { SCMP_SYS(set_robust_list), 245 },
+ { SCMP_SYS(lseek), 245 },
+ { SCMP_SYS(pselect6), 245 },
+ { SCMP_SYS(fork), 245 },
+ { SCMP_SYS(eventfd), 245 },
+ { SCMP_SYS(rt_sigprocmask), 245 },
+ { SCMP_SYS(write), 244 },
+ { SCMP_SYS(fcntl), 243 },
+ { SCMP_SYS(tgkill), 242 },
+ { SCMP_SYS(rt_sigaction), 242 },
+ { SCMP_SYS(pipe2), 242 },
+ { SCMP_SYS(munmap), 242 },
+ { SCMP_SYS(mremap), 242 },
+ { SCMP_SYS(fdatasync), 242 },
+ { SCMP_SYS(close), 242 },
+ { SCMP_SYS(rt_sigpending), 242 },
+ { SCMP_SYS(rt_sigtimedwait), 242 },
+ { SCMP_SYS(readv), 242 },
+ { SCMP_SYS(writev), 242 },
+ { SCMP_SYS(preadv), 242 },
+ { SCMP_SYS(pwritev), 242 },
+ { SCMP_SYS(setrlimit), 242 },
+ { SCMP_SYS(ftruncate), 242 },
+ { SCMP_SYS(lstat), 242 },
+ { SCMP_SYS(pipe), 242 },
+ { SCMP_SYS(umask), 242 },
+ { SCMP_SYS(chdir), 242 },
+ { SCMP_SYS(setitimer), 242 },
+ { SCMP_SYS(setsid), 242 },
+ { SCMP_SYS(poll), 242 },
+#if defined(__i386__)
+ { SCMP_SYS(waitpid), 242 },
+#elif defined(__x86_64__)
+ { SCMP_SYS(getsockname), 242 },
+ { SCMP_SYS(getpeername), 242 },
+ { SCMP_SYS(accept4), 242 },
+ { SCMP_SYS(newfstatat), 241 },
+ { SCMP_SYS(shutdown), 241 },
+ { SCMP_SYS(getsockopt), 241 },
+ { SCMP_SYS(semctl), 241 },
+ { SCMP_SYS(semop), 241 },
+ { SCMP_SYS(semtimedop), 241 },
+#endif
+ { SCMP_SYS(ppoll), 241 },
+ { SCMP_SYS(creat), 241 },
+ { SCMP_SYS(link), 241 },
+ { SCMP_SYS(getpid), 241 },
+ { SCMP_SYS(getppid), 241 },
+ { SCMP_SYS(getpgrp), 241 },
+ { SCMP_SYS(getpgid), 241 },
+ { SCMP_SYS(getsid), 241 },
+ { SCMP_SYS(getdents64), 241 },
+ { SCMP_SYS(getresuid), 241 },
+ { SCMP_SYS(getresgid), 241 },
+ { SCMP_SYS(getgroups), 241 },
+#if defined(__i386__)
+ { SCMP_SYS(getresuid32), 241 },
+ { SCMP_SYS(getresgid32), 241 },
+ { SCMP_SYS(getgroups32), 241 },
+ { SCMP_SYS(signal), 241 },
+ { SCMP_SYS(sigaction), 241 },
+ { SCMP_SYS(sigsuspend), 241 },
+ { SCMP_SYS(sigpending), 241 },
+ { SCMP_SYS(truncate64), 241 },
+ { SCMP_SYS(ftruncate64), 241 },
+ { SCMP_SYS(fchown32), 241 },
+ { SCMP_SYS(chown32), 241 },
+ { SCMP_SYS(lchown32), 241 },
+ { SCMP_SYS(statfs64), 241 },
+ { SCMP_SYS(fstatfs64), 241 },
+ { SCMP_SYS(fstatat64), 241 },
+ { SCMP_SYS(lstat64), 241 },
+ { SCMP_SYS(sendfile64), 241 },
+ { SCMP_SYS(ugetrlimit), 241 },
+#endif
+ { SCMP_SYS(alarm), 241 },
+ { SCMP_SYS(rt_sigsuspend), 241 },
+ { SCMP_SYS(rt_sigqueueinfo), 241 },
+ { SCMP_SYS(rt_tgsigqueueinfo), 241 },
+ { SCMP_SYS(sigaltstack), 241 },
+ { SCMP_SYS(signalfd4), 241 },
+ { SCMP_SYS(truncate), 241 },
+ { SCMP_SYS(fchown), 241 },
+ { SCMP_SYS(lchown), 241 },
+ { SCMP_SYS(fchownat), 241 },
+ { SCMP_SYS(fstatfs), 241 },
+ { SCMP_SYS(sendfile), 241 },
+ { SCMP_SYS(getitimer), 241 },
+ { SCMP_SYS(syncfs), 241 },
+ { SCMP_SYS(fsync), 241 },
+ { SCMP_SYS(fchdir), 241 },
+ { SCMP_SYS(flock), 241 },
+ { SCMP_SYS(msync), 241 },
+ { SCMP_SYS(sched_setparam), 241 },
+ { SCMP_SYS(sched_setscheduler), 241 },
+ { SCMP_SYS(sched_yield), 241 },
+ { SCMP_SYS(sched_rr_get_interval), 241 },
+ { SCMP_SYS(sched_setaffinity), 241 },
+ { SCMP_SYS(sched_getaffinity), 241 },
+ { SCMP_SYS(readahead), 241 },
+ { SCMP_SYS(timer_getoverrun), 241 },
+ { SCMP_SYS(unlinkat), 241 },
+ { SCMP_SYS(readlinkat), 241 },
+ { SCMP_SYS(faccessat), 241 },
+ { SCMP_SYS(get_robust_list), 241 },
+ { SCMP_SYS(splice), 241 },
+ { SCMP_SYS(vmsplice), 241 },
+ { SCMP_SYS(getcpu), 241 },
+ { SCMP_SYS(sendmmsg), 241 },
+ { SCMP_SYS(recvmmsg), 241 },
+ { SCMP_SYS(prlimit64), 241 },
+ { SCMP_SYS(waitid), 241 }
+};
#endif
-int seccomp_install_filter(void)
+#ifdef CONFIG_SECCOMP
+static int process_list(scmp_filter_ctx *ctx,
+ const struct QemuSeccompSyscall *list,
+ unsigned int list_size)
{
int rc = 0;
-#ifdef CONFIG_SECCOMP
unsigned int i = 0;
- scmp_filter_ctx ctx;
+
+ for (i = 0; i < list_size; i++) {
+ rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, list[i].num, 0);
+ if (rc < 0) {
+ return rc;
+ }
+
+ rc = seccomp_syscall_priority(ctx, list[i].num, list[i].priority);
+ if (rc < 0) {
+ return rc;
+ }
+ }
+ return rc;
+}
+#endif
+
+int seccomp_install_filter(int state)
+{
+ int rc = 0;
+#ifdef CONFIG_SECCOMP
+ scmp_filter_ctx ctx = NULL;
ctx = seccomp_init(SCMP_ACT_KILL);
if (ctx == NULL) {
@@ -256,21 +480,29 @@ int seccomp_install_filter(void)
goto seccomp_return;
}
- for (i = 0; i < ARRAY_SIZE(seccomp_whitelist); i++) {
- rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, seccomp_whitelist[i].num,
0);
+ switch (state) {
+ case SECCOMP_INIT:
+ rc = process_list(ctx, whitelist_init, ARRAY_SIZE(whitelist_init));
if (rc < 0) {
goto seccomp_return;
}
- rc = seccomp_syscall_priority(ctx, seccomp_whitelist[i].num,
- seccomp_whitelist[i].priority);
+ break;
+ case SECCOMP_MAIN_LOOP:
+ rc = process_list(ctx, whitelist_main, ARRAY_SIZE(whitelist_main));
if (rc < 0) {
goto seccomp_return;
}
+ break;
+ default:
+ rc = -1;
+ goto seccomp_return;
}
-
rc = seccomp_load(ctx);
seccomp_return:
+ if (rc == 0) {
+ seccomp_set_state(state);
+ }
seccomp_release(ctx);
#endif
return rc;
diff --git a/qemu-seccomp.h b/qemu-seccomp.h
index 686db09..029c111 100644
--- a/qemu-seccomp.h
+++ b/qemu-seccomp.h
@@ -28,6 +28,6 @@ enum seccomp_states {
void seccomp_set_state(int);
int seccomp_get_state(void);
-int seccomp_install_filter(void);
+int seccomp_install_filter(int);
#endif
diff --git a/vl.c b/vl.c
index cb3d85e..80b1fff 100644
--- a/vl.c
+++ b/vl.c
@@ -3483,7 +3483,7 @@ int main(int argc, char **argv, char **envp)
}
if (seccomp_get_state() == SECCOMP_ON) {
- if (seccomp_install_filter() < 0) {
+ if (seccomp_install_filter(SECCOMP_INIT) < 0) {
fprintf(stderr, "failed to install seccomp syscall "
"initialization filter\n");
exit(1);
@@ -3945,6 +3945,13 @@ int main(int argc, char **argv, char **envp)
os_setup_post();
resume_all_vcpus();
+ if (seccomp_get_state() >= SECCOMP_ON) {
+ if (seccomp_install_filter(SECCOMP_MAIN_LOOP) < 0) {
+ fprintf(stderr,
+ "failed to install seccomp syscall main loop filter\n");
+ exit(1);
+ }
+ }
main_loop();
bdrv_close_all();
pause_all_vcpus();
--
1.7.10.4
- [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Eduardo Otubo, 2012/11/12
- [Qemu-devel] [PATCHv3 3/5] net: Disallow device hotplug that causes execve(), Eduardo Otubo, 2012/11/12
- [Qemu-devel] [PATCHv3 2/5] seccomp: setting "-sandbox on" as deafult, Eduardo Otubo, 2012/11/12
- [Qemu-devel] [PATCHv3 4/5] seccomp: double whitelist support,
Eduardo Otubo <=
- [Qemu-devel] [PATCHv3 5/5] seccomp: adding debug mode, Eduardo Otubo, 2012/11/12
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Eduardo Otubo, 2012/11/21
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Paul Moore, 2012/11/21
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Corey Bryant, 2012/11/26
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Paul Moore, 2012/11/26
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Corey Bryant, 2012/11/26
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Paul Moore, 2012/11/26
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Paul Moore, 2012/11/26
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Corey Bryant, 2012/11/27
- Re: [Qemu-devel] [PATCHv3 1/5] seccomp: adding new syscalls (bugzilla 855162), Paul Moore, 2012/11/27