From patchwork Mon Nov 10 14:21:17 2014 Content-Type: text/plain; charset="utf-8" MIME-Version: 1.0 Content-Transfer-Encoding: 8bit X-Patchwork-Submitter: Eduardo Otubo X-Patchwork-Id: 408963 Return-Path: X-Original-To: incoming@patchwork.ozlabs.org Delivered-To: patchwork-incoming@bilbo.ozlabs.org Received: from lists.gnu.org (lists.gnu.org [IPv6:2001:4830:134:3::11]) (using TLSv1 with cipher AES256-SHA (256/256 bits)) (No client certificate requested) by ozlabs.org (Postfix) with ESMTPS id 5D89D14012A for ; Tue, 11 Nov 2014 01:22:51 +1100 (AEDT) Received: from localhost ([::1]:43556 helo=lists.gnu.org) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xnprl-0003lY-7a for incoming@patchwork.ozlabs.org; Mon, 10 Nov 2014 09:22:49 -0500 Received: from eggs.gnu.org ([2001:4830:134:3::10]:40224) by lists.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1Xnpqd-0001vm-Ob for qemu-devel@nongnu.org; Mon, 10 Nov 2014 09:21:45 -0500 Received: from Debian-exim by eggs.gnu.org with spam-scanned (Exim 4.71) (envelope-from ) id 1XnpqW-0004kp-Q8 for qemu-devel@nongnu.org; Mon, 10 Nov 2014 09:21:39 -0500 Received: from mail-wi0-f172.google.com ([209.85.212.172]:56436) by eggs.gnu.org with esmtp (Exim 4.71) (envelope-from ) id 1XnpqW-0004jq-Kd for qemu-devel@nongnu.org; Mon, 10 Nov 2014 09:21:32 -0500 Received: by mail-wi0-f172.google.com with SMTP id bs8so10795838wib.17 for ; Mon, 10 Nov 2014 06:21:25 -0800 (PST) X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20130820; h=x-gm-message-state:from:to:cc:subject:date:message-id:in-reply-to :references:mime-version:content-type:content-transfer-encoding; bh=P7PagWcG5uFPVBf5iKLzOq52o0/OCEUNJXc/KyVtQ+c=; b=DoRHVmTrT0dYW7tOEu9eQaOj7M1f1TylX2+GKG4MrEdpfFVNHgcagYLqQF5YW2CFVJ PcJpVpSAPw4M2zD7mrw+bvjkMT9w6NRRBMPYL+NEqtno9uX3i0POew7KBMPjp8/T78IO 3+KyUXBNRPxKo0nYZej+MQi9Lb7NtalREV+CuugVOJ/DxiyHGiRcHyQpI7wUEP+RJSTB wZWhHRNPoLWtUdoT+pMw3LdGNfmaim+mmD8y6E5LWoR/6xteiplYI4LGZ3zMWC4S5ped VvB6K2qpTeGaKpx2WwJsuLGe6Q968rIGPJ6J9++kiw1RjKXsCm4mMGpDgNno5S/eF0Y6 Yrqw== X-Gm-Message-State: ALoCoQllZbKCeDm7+BDh0Lk3RQPQEeaSIASw5A8an0HtLrHHmAQgSjWE2STrLBbNcFX6gR5pXZBj X-Received: by 10.180.211.108 with SMTP id nb12mr22803468wic.76.1415629285059; Mon, 10 Nov 2014 06:21:25 -0800 (PST) Received: from vader.pb.local ([62.217.45.26]) by mx.google.com with ESMTPSA id q10sm23364763wjq.35.2014.11.10.06.21.24 for (version=TLSv1.2 cipher=ECDHE-RSA-AES128-SHA bits=128/128); Mon, 10 Nov 2014 06:21:24 -0800 (PST) From: Eduardo Otubo To: qemu-devel@nongnu.org Date: Mon, 10 Nov 2014 15:21:17 +0100 Message-Id: <1415629278-24675-2-git-send-email-eduardo.otubo@profitbricks.com> X-Mailer: git-send-email 1.9.1 In-Reply-To: <1415629278-24675-1-git-send-email-eduardo.otubo@profitbricks.com> References: <1415629278-24675-1-git-send-email-eduardo.otubo@profitbricks.com> MIME-Version: 1.0 X-detected-operating-system: by eggs.gnu.org: GNU/Linux 2.2.x-3.x [generic] [fuzzy] X-Received-From: 209.85.212.172 Cc: pmoore@redhat.com, peter.maydell@linaro.org, philipp.gesang@intra2net.com Subject: [Qemu-devel] [PULL 1/2] seccomp: whitelist syscalls fallocate(), fadvise64(), inotify_init1() and inotify_add_watch() X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org Sender: qemu-devel-bounces+incoming=patchwork.ozlabs.org@nongnu.org From: Philipp Gesang fallocate() is needed for snapshotting. If it isn’t whitelisted $ qemu-img create -f qcow2 x.qcow 1G Formatting 'x.qcow', fmt=qcow2 size=1073741824 encryption=off cluster_size=65536 lazy_refcounts=off $ qemu-kvm -display none -monitor stdio -sandbox on x.qcow QEMU 2.1.50 monitor - type 'help' for more information (qemu) savevm foo (qemu) loadvm foo will fail, as will subsequent savevm commands on the same image. fadvise64(), inotify_init1(), inotify_add_watch() are needed by the SDL display. Without the whitelist entries, qemu-kvm -sandbox on fails immediately. In my tests fadvise64() is called 50--51 times per VM run. That number seems independent of the duration of the run. fallocate(), inotify_init1(), inotify_add_watch() are called once each. Accordingly, they are added to the whitelist at a very low priority. Signed-off-by: Philipp Gesang --- qemu-seccomp.c | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/qemu-seccomp.c b/qemu-seccomp.c index 0503764..af6a375 100644 --- a/qemu-seccomp.c +++ b/qemu-seccomp.c @@ -231,7 +231,11 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(shmctl), 240 }, { SCMP_SYS(mlock), 240 }, { SCMP_SYS(munlock), 240 }, - { SCMP_SYS(semctl), 240 } + { SCMP_SYS(semctl), 240 }, + { SCMP_SYS(fallocate), 240 }, + { SCMP_SYS(fadvise64), 240 }, + { SCMP_SYS(inotify_init1), 240 }, + { SCMP_SYS(inotify_add_watch), 240 } }; int seccomp_start(void)