From patchwork Mon Apr 14 18:00:59 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit X-Patchwork-Submitter: Eduardo Otubo X-Patchwork-Id: 339031 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [208.118.235.17]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 0EEDE14008F for ; Tue, 15 Apr 2014 04:11:57 +1000 (EST) Received: from localhost ([::1]:45152 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WZlMI-0004Ru-RO for incoming@patchwork.ozlabs.org; Mon, 14 Apr 2014 14:11:54 -0400 Received: from eggs.gnu.org ([2001:4830:134:3::10]:47399) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WZlLv-0004Q0-Np for qemu-devel@nongnu.org; Mon, 14 Apr 2014 14:11:39 -0400 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1WZlLn-0002OB-UN for qemu-devel@nongnu.org; Mon, 14 Apr 2014 14:11:31 -0400 Received: from e24smtp02.br.ibm.com ([32.104.18.86]:37212) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1WZlLn-0002Nx-H4 for qemu-devel@nongnu.org; Mon, 14 Apr 2014 14:11:23 -0400 Received: from /spool/local by e24smtp02.br.ibm.com with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted for from ; Mon, 14 Apr 2014 15:01:13 -0300 Received: from d24dlp01.br.ibm.com (9.18.248.204) by e24smtp02.br.ibm.com (10.172.0.142) with IBM ESMTP SMTP Gateway: Authorized Use Only! Violators will be prosecuted; Mon, 14 Apr 2014 15:01:10 -0300 Received: from d24relay03.br.ibm.com (d24relay03.br.ibm.com [9.13.184.25]) by d24dlp01.br.ibm.com (Postfix) with ESMTP id 6B3FA3520059 for ; Mon, 14 Apr 2014 14:01:06 -0400 (EDT) Received: from d24av01.br.ibm.com (d24av01.br.ibm.com [9.8.31.91]) by d24relay03.br.ibm.com (8.13.8/8.13.8/NCO v10.0) with ESMTP id s3EI0rcG14090380 for ; Mon, 14 Apr 2014 15:00:54 -0300 Received: from d24av01.br.ibm.com (localhost [127.0.0.1]) by d24av01.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVout) with ESMTP id s3EI18C5022840 for ; Mon, 14 Apr 2014 15:01:08 -0300 Received: from oc5082563337.ibm.com ([9.78.137.247]) by d24av01.br.ibm.com (8.14.4/8.14.4/NCO v10.0 AVin) with ESMTP id s3EI171E022809; Mon, 14 Apr 2014 15:01:07 -0300 From: Eduardo Otubo To: qemu-devel@nongnu.org Date: Mon, 14 Apr 2014 15:00:59 -0300 Message-Id: <1397498460-21829-2-git-send-email-otubo@linux.vnet.ibm.com> X-Mailer: git-send-email 1.7.1 In-Reply-To: <1397498460-21829-1-git-send-email-otubo@linux.vnet.ibm.com> References: <1397498460-21829-1-git-send-email-otubo@linux.vnet.ibm.com> X-TM-AS-MML: disable X-Content-Scanned: Fidelis XPS MAILER x-cbid: 14041418-2194-0000-0000-0000088C9012 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.4.x-2.6.x [generic] X-Received-From: 32.104.18.86 Cc: pmoore@redhat.com, debfx@fobos.de, Eduardo Otubo Subject: [Qemu-devel] [PULL 01/02] seccomp: add timerfd_create and timerfd_settime to the whitelist X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Felix Geyer libusb calls timerfd_create() and timerfd_settime() when it's built with timerfd support. Command to reproduce: -device usb-host,hostbus=1,hostaddr=3,id=hostdev0 Log messages: audit(1390730418.924:135): auid=4294967295 uid=121 gid=103 ses=4294967295 pid=5232 comm="qemu-system-x86" sig=31 syscall=283 compat=0 ip=0x7f2b0f4e96a7 code=0x0 audit(1390733100.580:142): auid=4294967295 uid=121 gid=103 ses=4294967295 pid=16909 comm="qemu-system-x86" sig=31 syscall=286 compat=0 ip=0x7f03513a06da code=0x0 Reading a few hundred MB from a USB drive on x86_64 shows this syscall distribution. Therefore the timerfd_settime priority is set to 242. calls syscall --------- ---------------- 5303600 write 2240554 read 2167030 ppoll 2134828 ioctl 704023 timerfd_settime 689105 poll 83122 futex 803 writev 476 rt_sigprocmask 287 recvmsg 178 brk Signed-off-by: Felix Geyer Signed-off-by: Eduardo Otubo Acked-by: Eduardo Otubo --- qemu-seccomp.c | 4 +++- 1 files changed, 3 insertions(+), 1 deletions(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index caa926e..46554bd 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -143,6 +143,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(getsockname), 242 }, { SCMP_SYS(getpeername), 242 }, { SCMP_SYS(accept4), 242 }, + { SCMP_SYS(timerfd_settime), 242 }, { SCMP_SYS(newfstatat), 241 }, { SCMP_SYS(shutdown), 241 }, { SCMP_SYS(getsockopt), 241 }, @@ -225,7 +226,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(fchmod), 240 }, { SCMP_SYS(shmget), 240 }, { SCMP_SYS(shmat), 240 }, - { SCMP_SYS(shmdt), 240 } + { SCMP_SYS(shmdt), 240 }, + { SCMP_SYS(timerfd_create), 240 } }; int seccomp_start(void)