| Message ID | 1350971732-16621-1-git-send-email-otubo@linux.vnet.ibm.com |
|---|---|
| State | New |
| Headers | show |
On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote: > According to the bug 855162[0] - there's the need of adding new syscalls > to the whitelist whenn using Qemu with Libvirt. > > [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162 > > v2: Adding new syscalls to the list: readlink, rt_sigpending, and > rt_sigtimedwait > > Reported-by: Paul Moore <pmoore@redhat.com> > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> > --- > qemu-seccomp.c | 13 ++++++++++++- > 1 file changed, 12 insertions(+), 1 deletion(-) I had an opportunity to test this patchset on a F17 machine using QEMU 1.2 and unfortunately it still fails. I'm using a relatively basic guest configuration running F16, the details are documented in the RH BZ that Eduardo mentioned in the patch description. Eduardo, I assume you are not able to reproduce this? > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > index 64329a3..a7b33e2 100644 > --- a/qemu-seccomp.c > +++ b/qemu-seccomp.c > @@ -45,6 +45,13 @@ static const struct QemuSeccompSyscall > seccomp_whitelist[] = { { SCMP_SYS(access), 245 }, > { SCMP_SYS(prctl), 245 }, > { SCMP_SYS(signalfd), 245 }, > + { SCMP_SYS(getrlimit), 245 }, > + { SCMP_SYS(set_tid_address), 245 }, > + { SCMP_SYS(socketpair), 245 }, > + { SCMP_SYS(statfs), 245 }, > + { SCMP_SYS(unlink), 245 }, > + { SCMP_SYS(wait4), 245 }, > + { SCMP_SYS(getuid), 245 }, > #if defined(__i386__) > { SCMP_SYS(fcntl64), 245 }, > { SCMP_SYS(fstat64), 245 }, > @@ -107,7 +114,11 @@ static const struct QemuSeccompSyscall > seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, > { SCMP_SYS(getpeername), 242 }, > { SCMP_SYS(fdatasync), 242 }, > - { SCMP_SYS(close), 242 } > + { SCMP_SYS(close), 242 }, > + { SCMP_SYS(accept4), 242 }, > + { SCMP_SYS(readlink), 242 }, > + { SCMP_SYS(rt_sigpending), 242 }, > + { SCMP_SYS(rt_sigtimedwait), 242 } > }; > > int seccomp_start(void)
On Thu, Nov 01, 2012 at 05:43:03PM -0400, Paul Moore wrote: > On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote: > > According to the bug 855162[0] - there's the need of adding new syscalls > > to the whitelist whenn using Qemu with Libvirt. > > > > [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162 > > > > v2: Adding new syscalls to the list: readlink, rt_sigpending, and > > rt_sigtimedwait > > > > Reported-by: Paul Moore <pmoore@redhat.com> > > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> > > --- > > qemu-seccomp.c | 13 ++++++++++++- > > 1 file changed, 12 insertions(+), 1 deletion(-) > > I had an opportunity to test this patchset on a F17 machine using QEMU 1.2 and > unfortunately it still fails. I'm using a relatively basic guest > configuration running F16, the details are documented in the RH BZ that > Eduardo mentioned in the patch description. > > Eduardo, I assume you are not able to reproduce this? Unfortunately no. But we have the v3 patchset coming soon with new syscalls and we're hoping to get this fixed. Thanks for the feedback Paul! > > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c > > index 64329a3..a7b33e2 100644 > > --- a/qemu-seccomp.c > > +++ b/qemu-seccomp.c > > @@ -45,6 +45,13 @@ static const struct QemuSeccompSyscall > > seccomp_whitelist[] = { { SCMP_SYS(access), 245 }, > > { SCMP_SYS(prctl), 245 }, > > { SCMP_SYS(signalfd), 245 }, > > + { SCMP_SYS(getrlimit), 245 }, > > + { SCMP_SYS(set_tid_address), 245 }, > > + { SCMP_SYS(socketpair), 245 }, > > + { SCMP_SYS(statfs), 245 }, > > + { SCMP_SYS(unlink), 245 }, > > + { SCMP_SYS(wait4), 245 }, > > + { SCMP_SYS(getuid), 245 }, > > #if defined(__i386__) > > { SCMP_SYS(fcntl64), 245 }, > > { SCMP_SYS(fstat64), 245 }, > > @@ -107,7 +114,11 @@ static const struct QemuSeccompSyscall > > seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, > > { SCMP_SYS(getpeername), 242 }, > > { SCMP_SYS(fdatasync), 242 }, > > - { SCMP_SYS(close), 242 } > > + { SCMP_SYS(close), 242 }, > > + { SCMP_SYS(accept4), 242 }, > > + { SCMP_SYS(readlink), 242 }, > > + { SCMP_SYS(rt_sigpending), 242 }, > > + { SCMP_SYS(rt_sigtimedwait), 242 } > > }; > > > > int seccomp_start(void) > -- > paul moore > security and virtualization @ redhat >
On Friday, November 02, 2012 12:29:37 AM Eduardo Otubo wrote: > On Thu, Nov 01, 2012 at 05:43:03PM -0400, Paul Moore wrote: > > On Tuesday, October 23, 2012 03:55:29 AM Eduardo Otubo wrote: > > > According to the bug 855162[0] - there's the need of adding new syscalls > > > to the whitelist whenn using Qemu with Libvirt. > > > > > > [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162 > > > > > > v2: Adding new syscalls to the list: readlink, rt_sigpending, and > > > > > > rt_sigtimedwait > > > > > > Reported-by: Paul Moore <pmoore@redhat.com> > > > Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> > > > --- > > > > > > qemu-seccomp.c | 13 ++++++++++++- > > > 1 file changed, 12 insertions(+), 1 deletion(-) > > > > I had an opportunity to test this patchset on a F17 machine using QEMU 1.2 > > and unfortunately it still fails. I'm using a relatively basic guest > > configuration running F16, the details are documented in the RH BZ that > > Eduardo mentioned in the patch description. > > > > Eduardo, I assume you are not able to reproduce this? > > Unfortunately no. But we have the v3 patchset coming soon with new > syscalls and we're hoping to get this fixed. Thanks for the feedback > Paul! No problem, thanks for all your work on this patchset.
diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 64329a3..a7b33e2 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -45,6 +45,13 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(access), 245 }, { SCMP_SYS(prctl), 245 }, { SCMP_SYS(signalfd), 245 }, + { SCMP_SYS(getrlimit), 245 }, + { SCMP_SYS(set_tid_address), 245 }, + { SCMP_SYS(socketpair), 245 }, + { SCMP_SYS(statfs), 245 }, + { SCMP_SYS(unlink), 245 }, + { SCMP_SYS(wait4), 245 }, + { SCMP_SYS(getuid), 245 }, #if defined(__i386__) { SCMP_SYS(fcntl64), 245 }, { SCMP_SYS(fstat64), 245 }, @@ -107,7 +114,11 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, { SCMP_SYS(getpeername), 242 }, { SCMP_SYS(fdatasync), 242 }, - { SCMP_SYS(close), 242 } + { SCMP_SYS(close), 242 }, + { SCMP_SYS(accept4), 242 }, + { SCMP_SYS(readlink), 242 }, + { SCMP_SYS(rt_sigpending), 242 }, + { SCMP_SYS(rt_sigtimedwait), 242 } }; int seccomp_start(void)
According to the bug 855162[0] - there's the need of adding new syscalls to the whitelist whenn using Qemu with Libvirt. [0] - https://bugzilla.redhat.com/show_bug.cgi?id=855162 v2: Adding new syscalls to the list: readlink, rt_sigpending, and rt_sigtimedwait Reported-by: Paul Moore <pmoore@redhat.com> Signed-off-by: Eduardo Otubo <otubo@linux.vnet.ibm.com> --- qemu-seccomp.c | 13 ++++++++++++- 1 file changed, 12 insertions(+), 1 deletion(-)