qemu-devel
[Top][All Lists]
Advanced

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist


From: Eduardo Otubo
Subject: Re: [Qemu-devel] [PATCH] seccomp: adding a second whitelist
Date: Fri, 30 Aug 2013 11:27:28 -0300
User-agent: Mozilla/5.0 (X11; Linux x86_64; rv:17.0) Gecko/20130621 Thunderbird/17.0.7



On 08/29/2013 09:56 AM, Paul Moore wrote:
On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote:
Now there's a second whitelist, right before the vcpu starts. The second
whitelist is the same as the first one, except for exec() and select().

Signed-off-by: Eduardo Otubo <address@hidden>

We talked about this in a previous thread, but as a reminder, the kernel's
seccomp BPF filter works by executing all of the loaded filters for each
syscall and taking the least permissive action for all of the results.  In
other words, if one filter returns ALLOW for a given syscall and another
filter returns KILL, the kernel will select the KILL action for the syscall.

With that in mind, I think the best option is to keep the existing whitelist
and instead of creating a second whitelist, create a second *blacklist* that
removes the syscalls you don't want to allow anymore, e.g. exec() and
select().  This approach should be easier to maintain and would result in less
overhead in the kernel's seccomp evaluator (the blacklist filter would be much
smaller than a second whitelist filter).

You're correct. I was thinking in a whole other approach, but your point makes a lot more sense. As I mentioned on the IRC, I should call seccomp_init(SCMP_ACT_ALLOW) and seccomp_rule_add(ctx, SCMP_ACT_KILL, list[i].num, 0); is that correct?

Thanks,

--
Eduardo Otubo
IBM Linux Technology Center




reply via email to

[Prev in Thread] Current Thread [Next in Thread]