From patchwork Wed Aug 15 22:44:42 2012 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Anthony Liguori X-Patchwork-Id: 177878 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (Client did not present a certificate) by ozlabs.org (Postfix) with ESMTPS id F0EAD2C008D for ; Thu, 16 Aug 2012 08:46:53 +1000 (EST) Received: from localhost ([::1]:34354 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T1mMW-0006Zo-5O for incoming@patchwork.ozlabs.org; Wed, 15 Aug 2012 18:46:52 -0400 Received: from eggs.gnu.org ([208.118.235.92]:41182) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T1mMM-0006ZW-VV for qemu-devel@nongnu.org; Wed, 15 Aug 2012 18:46:45 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1T1mML-0002mR-Ku for qemu-devel@nongnu.org; Wed, 15 Aug 2012 18:46:42 -0400 Received: from e39.co.us.ibm.com ([32.97.110.160]:33643) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1T1mML-0002mM-E7 for qemu-devel@nongnu.org; Wed, 15 Aug 2012 18:46:41 -0400 Received: from /spool/local by e39.co.us.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Wed, 15 Aug 2012 16:46:40 -0600 Received: from d03dlp03.boulder.ibm.com (9.17.202.179) by e39.co.us.ibm.com (192.168.1.139) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Wed, 15 Aug 2012 16:45:48 -0600 Received: from d03relay02.boulder.ibm.com (d03relay02.boulder.ibm.com [9.17.195.227]) by d03dlp03.boulder.ibm.com (Postfix) with ESMTP id 6C05319D8043 for ; Wed, 15 Aug 2012 16:45:32 -0600 (MDT) Received: from d03av06.boulder.ibm.com (d03av06.boulder.ibm.com [9.17.195.245]) by d03relay02.boulder.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id q7FMj6Dd105906 for ; Wed, 15 Aug 2012 16:45:16 -0600 Received: from d03av06.boulder.ibm.com (loopback [127.0.0.1]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVout) with ESMTP id q7FMkAhE011323 for ; Wed, 15 Aug 2012 16:46:10 -0600 Received: from titi.austin.rr.com ([9.57.71.37]) by d03av06.boulder.ibm.com (8.14.4/8.13.1/NCO v10.0 AVin) with ESMTP id q7FMk3ft011079; Wed, 15 Aug 2012 16:46:09 -0600 From: Anthony Liguori To: qemu-devel@nongnu.org Date: Wed, 15 Aug 2012 17:44:42 -0500 Message-Id: <1345070682-8675-5-git-send-email-aliguori@us.ibm.com> X-Mailer: git-send-email 1.7.5.4 In-Reply-To: <1345070682-8675-1-git-send-email-aliguori@us.ibm.com> References: <1345070682-8675-1-git-send-email-aliguori@us.ibm.com> X-Content-Scanned: Fidelis XPS MAILER x-cbid: 12081522-4242-0000-0000-0000029B33CA X-detected-operating-system: by eggs.gnu.org: Genre and OS details not recognized. X-Received-From: 32.97.110.160 Cc: Paul Moore , Anthony Liguori , Eduardo Otubo Subject: [Qemu-devel] [PATCH 4/4] Command line support for seccomp with -sandbox (v8) X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Eduardo Otubo Signed-off-by: Eduardo Otubo Signed-off-by: Anthony Liguori --- v7 -> v8 - Parse options correctly (aliguori) --- qemu-config.c | 14 ++++++++++++++ qemu-config.h | 1 + qemu-options.hx | 10 ++++++++++ vl.c | 38 ++++++++++++++++++++++++++++++-------- 4 files changed, 55 insertions(+), 8 deletions(-) diff --git a/qemu-config.c b/qemu-config.c index 6700de0..c05ffbc 100644 --- a/qemu-config.c +++ b/qemu-config.c @@ -362,6 +362,19 @@ static QemuOptsList qemu_global_opts = { }, }; +QemuOptsList qemu_sandbox_opts = { + .name = "sandbox", + .implied_opt_name = "enable", + .head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head), + .desc = { + { + .name = "enable", + .type = QEMU_OPT_BOOL, + }, + { /* end of list */ } + }, +}; + static QemuOptsList qemu_mon_opts = { .name = "mon", .implied_opt_name = "chardev", @@ -645,6 +658,7 @@ static QemuOptsList *vm_config_groups[32] = { &qemu_machine_opts, &qemu_boot_opts, &qemu_iscsi_opts, + &qemu_sandbox_opts, NULL, }; diff --git a/qemu-config.h b/qemu-config.h index 12ddf3e..5557562 100644 --- a/qemu-config.h +++ b/qemu-config.h @@ -6,6 +6,7 @@ extern QemuOptsList qemu_fsdev_opts; extern QemuOptsList qemu_virtfs_opts; extern QemuOptsList qemu_spice_opts; +extern QemuOptsList qemu_sandbox_opts; QemuOptsList *qemu_find_opts(const char *group); QemuOptsList *qemu_find_opts_err(const char *group, Error **errp); diff --git a/qemu-options.hx b/qemu-options.hx index 6aeef6a..3c411c4 100644 --- a/qemu-options.hx +++ b/qemu-options.hx @@ -2723,6 +2723,16 @@ STEXI Old param mode (ARM only). ETEXI +DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \ + "-sandbox Enable seccomp mode 2 system call filter (default 'off').\n", + QEMU_ARCH_ALL) +STEXI +@item -sandbox +@findex -sandbox +Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will +disable it. The default is 'off'. +ETEXI + DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig, "-readconfig \n", QEMU_ARCH_ALL) STEXI diff --git a/vl.c b/vl.c index 1010248..124d30d 100644 --- a/vl.c +++ b/vl.c @@ -770,6 +770,26 @@ static int bt_parse(const char *opt) return 1; } +static int parse_sandbox(QemuOpts *opts, void *opaque) +{ + /* FIXME: change this to true for 1.3 */ + if (qemu_opt_get_bool(opts, "enable", false)) { +#ifdef CONFIG_SECCOMP + if (seccomp_start() < 0) { + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "failed to install seccomp syscall filter in the kernel"); + return -1; + } +#else + qerror_report(ERROR_CLASS_GENERIC_ERROR, + "sandboxing request but seccomp is not compiled into this build"); + return -1; +#endif + } + + return 0; +} + /***********************************************************/ /* QEMU Block devices */ @@ -2349,14 +2369,6 @@ int main(int argc, char **argv, char **envp) const char *trace_events = NULL; const char *trace_file = NULL; -#ifdef CONFIG_SECCOMP - if (seccomp_start() < 0) { - fprintf(stderr, - "seccomp: failed to install syscall filter in the kernel\n"); - exit(1); - } -#endif - atexit(qemu_run_exit_notifiers); error_set_progname(argv[0]); @@ -3260,6 +3272,12 @@ int main(int argc, char **argv, char **envp) case QEMU_OPTION_qtest_log: qtest_log = optarg; break; + case QEMU_OPTION_sandbox: + opts = qemu_opts_parse(qemu_find_opts("sandbox"), optarg, 1); + if (!opts) { + exit(0); + } + break; default: os_parse_cmd_args(popt->index, optarg); } @@ -3267,6 +3285,10 @@ int main(int argc, char **argv, char **envp) } loc_set_none(); + if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL, 0)) { + exit(1); + } + if (machine == NULL) { fprintf(stderr, "No machine found.\n"); exit(1);