On Tuesday, October 23, 2012 03:55:31 AM Eduardo Otubo wrote: > This patch includes a second whitelist right before the main loop. It's > a smaller and more restricted whitelist, excluding execve() among many > others. > > v2: * ctx changed to main_loop_ctx > * seccomp_on now inside ifdef > * open syscall added to the main_loop whitelist > > Signed-off-by: Eduardo Otubo <ot...@linux.vnet.ibm.com>
Unfortunately qemu.org seems to be down for me today so I can't grab the latest repo to review/verify this patch (some of my comments/assumptions below may be off) but I'm a little confused, hopefully you guys can help me out, read below ... The first call to seccomp_install_filter() will setup a whitelist for the syscalls that have been explicitly specified, all others will hit the default action TRAP/KILL. The second call to seccomp_install_filter() will add a second whitelist for another set of explicitly specified syscalls, all others will hit the default action TRAP/KILL. The problem occurs when the filters are executed in the kernel when a syscall is executed. On each syscall the first filter will be executed and the action will either be ALLOW or TRAP/KILL, next the second filter will be executed and the action will either be ALLOW or TRAP/KILL; since the kernel always takes the most restrictive (lowest integer action value) action when multiple filters are specified, I think your double whitelist value is going to have some inherent problems. I might suggest an initial, fairly permissive whitelist followed by a follow-on blacklist if you want to disable certain syscalls. -- paul moore security and virtualization @ redhat
