Patchwork New syscalls to the seccomp whitelist

login
register
mail settings
Submitter Eduardo Otubo
Date Sept. 20, 2012, 9 p.m.
Message ID <1348174859-24809-1-git-send-email-otubo@linux.vnet.ibm.com>
Download mbox | patch
Permalink /patch/185507/
State New
Headers show

Comments

Eduardo Otubo - Sept. 20, 2012, 9 p.m.
Seccomp syscall whitelist updated after tests running qemu under
libvirt. Reference to the bug -
https://bugzilla.redhat.com/show_bug.cgi?id=855162

Regards,
---
 qemu-seccomp.c | 21 ++++++++++++++++++++-
 1 file changed, 20 insertions(+), 1 deletion(-)
Kevin Wolf - Sept. 21, 2012, 11:21 a.m.
Am 20.09.2012 23:00, schrieb Eduardo Otubo:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt. Reference to the bug -
> https://bugzilla.redhat.com/show_bug.cgi?id=855162
> 
> Regards,
> ---
>  qemu-seccomp.c | 21 ++++++++++++++++++++-
>  1 file changed, 20 insertions(+), 1 deletion(-)

SoB is missing.

Kevin
Paul Moore - Sept. 26, 2012, 3:14 p.m.
On Thursday, September 20, 2012 06:00:59 PM Eduardo Otubo wrote:
> Seccomp syscall whitelist updated after tests running qemu under
> libvirt ...

Hi Eduardo,

I know from our discussions offlist that you have an additional debugging 
patch to help identify missing syscalls, perhaps you could also submit that 
patch too?  I think we would want the debugging patch #ifdef'd out in normal 
use, but I think it might help the QEMU developers.
Eduardo Otubo - Sept. 26, 2012, 4:24 p.m.
On Wed, Sep 26, 2012 at 11:14:29AM -0400, Paul Moore wrote:
> On Thursday, September 20, 2012 06:00:59 PM Eduardo Otubo wrote:
> > Seccomp syscall whitelist updated after tests running qemu under
> > libvirt ...
> 
> Hi Eduardo,
> 
> I know from our discussions offlist that you have an additional debugging 
> patch to help identify missing syscalls, perhaps you could also submit that 
> patch too?  I think we would want the debugging patch #ifdef'd out in normal 
> use, but I think it might help the QEMU developers.

That's surely a good thing Paul. I'll rebase my patches and send it
right away.  Thanks!
Paul Moore - Sept. 26, 2012, 4:42 p.m.
On Wednesday, September 26, 2012 01:24:54 PM Eduardo Otubo wrote:
> On Wed, Sep 26, 2012 at 11:14:29AM -0400, Paul Moore wrote:
> > On Thursday, September 20, 2012 06:00:59 PM Eduardo Otubo wrote:
> > > Seccomp syscall whitelist updated after tests running qemu under
> > > libvirt ...
> > 
> > Hi Eduardo,
> > 
> > I know from our discussions offlist that you have an additional debugging
> > patch to help identify missing syscalls, perhaps you could also submit
> > that patch too?  I think we would want the debugging patch #ifdef'd out in
> > normal use, but I think it might help the QEMU developers.
> 
> That's surely a good thing Paul. I'll rebase my patches and send it
> right away.  Thanks!

Great, I think that will be a nice addition.

Also, FWIW, I don't think you need to rebase/resubmit the patch you already 
sent, just port your debugging patch to go on top.

Patch

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 64329a3..4712338 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -70,6 +70,7 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(setsockopt), 245},
     { SCMP_SYS(uname), 245},
     { SCMP_SYS(semget), 245},
+    { SCMP_SYS(accept4), 241 },
 #endif
     { SCMP_SYS(eventfd2), 245 },
     { SCMP_SYS(dup), 245 },
@@ -107,7 +108,25 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(getsockname), 242 },
     { SCMP_SYS(getpeername), 242 },
     { SCMP_SYS(fdatasync), 242 },
-    { SCMP_SYS(close), 242 }
+    { SCMP_SYS(close), 242 },
+    { SCMP_SYS(unlink), 241 },
+    { SCMP_SYS(statfs), 241 },
+    { SCMP_SYS(getuid), 241 },
+    { SCMP_SYS(ftruncate), 241 },
+    { SCMP_SYS(getegid), 241 },
+    { SCMP_SYS(geteuid), 241 },
+    { SCMP_SYS(getgid), 241 },
+    { SCMP_SYS(getrlimit), 241 },
+    { SCMP_SYS(set_tid_address), 241 },
+    { SCMP_SYS(socketpair), 241 },
+    { SCMP_SYS(fstatfs), 241 },
+    { SCMP_SYS(epoll_create), 241 },
+    { SCMP_SYS(epoll_ctl), 241 },
+    { SCMP_SYS(epoll_wait), 241 },
+    { SCMP_SYS(pipe), 241 },
+    { SCMP_SYS(poll), 241 },
+    { SCMP_SYS(rt_sigpending), 241 },
+    { SCMP_SYS(rt_sigtimedwait), 241 },
 };
 
 int seccomp_start(void)