Patchwork [PATCHv2,1/4] Adding new syscalls (bugzilla 855162)

login
register
mail settings
Submitter Eduardo Otubo
Date Oct. 23, 2012, 5:55 a.m.
Message ID <1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com>
Download mbox | patch
Permalink /patch/193357/
State New
Headers show

Comments

Eduardo Otubo - Oct. 23, 2012, 5:55 a.m.
According to the bug 855162[0] - there's the need of adding new syscalls
to the whitelist whenn using Qemu with Libvirt.

[0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162

v2: Adding new syscalls to the list: readlink, rt_sigpending, and 
    rt_sigtimedwait

Reported-by: Paul Moore <pmoore@redhat.com>
Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
---
 qemu-seccomp.c | 13 ++++++++++++-
 1 file changed, 12 insertions(+), 1 deletion(-)
Paul Moore - Nov. 1, 2012, 9:43 p.m.
On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote:
> According to the bug 855162[0] - there's the need of adding new syscalls
> to the whitelist whenn using Qemu with Libvirt.
> 
> [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162
> 
> v2: Adding new syscalls to the list: readlink, rt_sigpending, and
>     rt_sigtimedwait
> 
> Reported-by: Paul Moore <pmoore@redhat.com>
> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> ---
>  qemu-seccomp.c | 13 ++++++++++++-
>  1 file changed, 12 insertions(+), 1 deletion(-)

I had an opportunity to test this patchset on a F17 machine using QEMU 1.2 and 
unfortunately it still fails.  I'm using a relatively basic guest 
configuration running F16, the details are documented in the RH BZ that 
Eduardo mentioned in the patch description.

Eduardo, I assume you are not able to reproduce this?

> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 64329a3..a7b33e2 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -45,6 +45,13 @@ static const struct QemuSeccompSyscall
> seccomp_whitelist[] = { { SCMP_SYS(access), 245 },
>      { SCMP_SYS(prctl), 245 },
>      { SCMP_SYS(signalfd), 245 },
> +    { SCMP_SYS(getrlimit), 245 },
> +    { SCMP_SYS(set_tid_address), 245 },
> +    { SCMP_SYS(socketpair), 245 },
> +    { SCMP_SYS(statfs), 245 },
> +    { SCMP_SYS(unlink), 245 },
> +    { SCMP_SYS(wait4), 245 },
> +    { SCMP_SYS(getuid), 245 },
>  #if defined(__i386__)
>      { SCMP_SYS(fcntl64), 245 },
>      { SCMP_SYS(fstat64), 245 },
> @@ -107,7 +114,11 @@ static const struct QemuSeccompSyscall
> seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 },
>      { SCMP_SYS(getpeername), 242 },
>      { SCMP_SYS(fdatasync), 242 },
> -    { SCMP_SYS(close), 242 }
> +    { SCMP_SYS(close), 242 },
> +    { SCMP_SYS(accept4), 242 },
> +    { SCMP_SYS(readlink), 242 },
> +    { SCMP_SYS(rt_sigpending), 242 },
> +    { SCMP_SYS(rt_sigtimedwait), 242 }
>  };
> 
>  int seccomp_start(void)
Eduardo Otubo - Nov. 2, 2012, 2:29 a.m.
On Thu, Nov 01, 2012 at 05:43:03PM -0400, Paul Moore wrote:
> On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote:
> > According to the bug 855162[0] - there's the need of adding new syscalls
> > to the whitelist whenn using Qemu with Libvirt.
> > 
> > [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162
> > 
> > v2: Adding new syscalls to the list: readlink, rt_sigpending, and
> >     rt_sigtimedwait
> > 
> > Reported-by: Paul Moore <pmoore@redhat.com>
> > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> > ---
> >  qemu-seccomp.c | 13 ++++++++++++-
> >  1 file changed, 12 insertions(+), 1 deletion(-)
> 
> I had an opportunity to test this patchset on a F17 machine using QEMU 1.2 and 
> unfortunately it still fails.  I'm using a relatively basic guest 
> configuration running F16, the details are documented in the RH BZ that 
> Eduardo mentioned in the patch description.
> 
> Eduardo, I assume you are not able to reproduce this?

Unfortunately no. But we have the v3  patchset coming soon with new
syscalls and we're hoping to get this fixed. Thanks for the feedback
Paul!

> 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 64329a3..a7b33e2 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -45,6 +45,13 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = { { SCMP_SYS(access), 245 },
> >      { SCMP_SYS(prctl), 245 },
> >      { SCMP_SYS(signalfd), 245 },
> > +    { SCMP_SYS(getrlimit), 245 },
> > +    { SCMP_SYS(set_tid_address), 245 },
> > +    { SCMP_SYS(socketpair), 245 },
> > +    { SCMP_SYS(statfs), 245 },
> > +    { SCMP_SYS(unlink), 245 },
> > +    { SCMP_SYS(wait4), 245 },
> > +    { SCMP_SYS(getuid), 245 },
> >  #if defined(__i386__)
> >      { SCMP_SYS(fcntl64), 245 },
> >      { SCMP_SYS(fstat64), 245 },
> > @@ -107,7 +114,11 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 },
> >      { SCMP_SYS(getpeername), 242 },
> >      { SCMP_SYS(fdatasync), 242 },
> > -    { SCMP_SYS(close), 242 }
> > +    { SCMP_SYS(close), 242 },
> > +    { SCMP_SYS(accept4), 242 },
> > +    { SCMP_SYS(readlink), 242 },
> > +    { SCMP_SYS(rt_sigpending), 242 },
> > +    { SCMP_SYS(rt_sigtimedwait), 242 }
> >  };
> > 
> >  int seccomp_start(void)
> -- 
> paul moore
> security and virtualization @ redhat
>
Paul Moore - Nov. 2, 2012, 2:10 p.m.
On Friday, November 02, 2012 12:29:37 AM Eduardo Otubo wrote:
> On Thu, Nov 01, 2012 at 05:43:03PM -0400, Paul Moore wrote:
> > On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote:
> > > According to the bug 855162[0] - there's the need of adding new syscalls
> > > to the whitelist whenn using Qemu with Libvirt.
> > > 
> > > [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162
> > > 
> > > v2: Adding new syscalls to the list: readlink, rt_sigpending, and
> > > 
> > >     rt_sigtimedwait
> > > 
> > > Reported-by: Paul Moore <pmoore@redhat.com>
> > > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com>
> > > ---
> > > 
> > >  qemu-seccomp.c | 13 ++++++++++++-
> > >  1 file changed, 12 insertions(+), 1 deletion(-)
> > 
> > I had an opportunity to test this patchset on a F17 machine using QEMU 1.2
> > and unfortunately it still fails.  I'm using a relatively basic guest
> > configuration running F16, the details are documented in the RH BZ that
> > Eduardo mentioned in the patch description.
> > 
> > Eduardo, I assume you are not able to reproduce this?
> 
> Unfortunately no. But we have the v3  patchset coming soon with new
> syscalls and we're hoping to get this fixed. Thanks for the feedback
> Paul!

No problem, thanks for all your work on this patchset.

Patch

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 64329a3..a7b33e2 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -45,6 +45,13 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(access), 245 },
     { SCMP_SYS(prctl), 245 },
     { SCMP_SYS(signalfd), 245 },
+    { SCMP_SYS(getrlimit), 245 },
+    { SCMP_SYS(set_tid_address), 245 },
+    { SCMP_SYS(socketpair), 245 },
+    { SCMP_SYS(statfs), 245 },
+    { SCMP_SYS(unlink), 245 },
+    { SCMP_SYS(wait4), 245 },
+    { SCMP_SYS(getuid), 245 },
 #if defined(__i386__)
     { SCMP_SYS(fcntl64), 245 },
     { SCMP_SYS(fstat64), 245 },
@@ -107,7 +114,11 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(getsockname), 242 },
     { SCMP_SYS(getpeername), 242 },
     { SCMP_SYS(fdatasync), 242 },
-    { SCMP_SYS(close), 242 }
+    { SCMP_SYS(close), 242 },
+    { SCMP_SYS(accept4), 242 },
+    { SCMP_SYS(readlink), 242 },
+    { SCMP_SYS(rt_sigpending), 242 },
+    { SCMP_SYS(rt_sigtimedwait), 242 }
 };
 
 int seccomp_start(void)