Now the seccomp filter will be set to "on" even if no argument
"-sandbox" is given.
v3: * Introduced seccomp_states enum and new functions named
seccomp_set_state() and seccomp_get_state()
(pbonz...@redhat.com).
* Merged seccomp_start() and install_seccomp_filter(),
moved install_seccomp_filter() to qemu-seccomp.c,
and renamed it.
* Moved CONFIG_SECCOMP pre-processor checks from Makefile.objs
to qemu-seccomp.c.
* Replace qerror_report with fprintf(stderr, "..") in main()
(lcapitul...@redhat.com).
Note: This support requires libseccomp. If you don't have access
to libseccomp packages, you can manually build with the following
steps:
1) git clone git://git.code.sf.net/p/libseccomp/libseccomp
2) cd libseccomp
3) ./configure
4) make
5) make install
6) export PKG_CONFIG_PATH="/usr/local/lib/pkgconfig/"
Signed-off-by: Eduardo Otubo <ot...@linux.vnet.ibm.com>
Signed-off-by: Corey Bryant <cor...@linux.vnet.ibm.com>
---
Makefile.objs | 2 --
configure | 2 +-
qemu-seccomp.c | 26 ++++++++++++++++++++++++--
qemu-seccomp.h | 13 +++++++++++--
vl.c | 31 ++++++++++++++++---------------
5 files changed, 52 insertions(+), 22 deletions(-)
diff --git a/Makefile.objs b/Makefile.objs
index 593a592..682b1e6 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -103,9 +103,7 @@ common-obj-$(CONFIG_SLIRP) += slirp/
######################################################################
# libseccomp
-ifeq ($(CONFIG_SECCOMP),y)
common-obj-y += qemu-seccomp.o
-endif
######################################################################
# libuser
diff --git a/configure b/configure
index 7290f50..d28f8d5 100755
--- a/configure
+++ b/configure
@@ -221,7 +221,7 @@ guest_agent="yes"
want_tools="yes"
libiscsi=""
coroutine=""
-seccomp=""
+seccomp="yes"
glusterfs=""
# parse CC options first
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index b06a2c6..2386996 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -12,10 +12,28 @@
* Contributions after 2012-01-13 are licensed under the terms of the
* GNU GPL, version 2 or (at your option) any later version.
*/
+#include "config-host.h"
#include <stdio.h>
-#include <seccomp.h>
+#include "osdep.h"
#include "qemu-seccomp.h"
+#ifdef CONFIG_SECCOMP
+int seccomp_state = SECCOMP_ON;
+#else
+int seccomp_state = SECCOMP_OFF;
+#endif
+
+void seccomp_set_state(int state)
+{
+ seccomp_state = state;
+}
+
+int seccomp_get_state(void)
+{
+ return seccomp_state;
+}
+
+#ifdef CONFIG_SECCOMP
struct QemuSeccompSyscall {
int32_t num;
uint8_t priority;
@@ -223,15 +241,18 @@ static const struct QemuSeccompSyscall
seccomp_whitelist[] = {
{ SCMP_SYS(prlimit64), 241 },
{ SCMP_SYS(waitid), 241 }
};
+#endif
-int seccomp_start(void)
+int seccomp_install_filter(void)
{
int rc = 0;
+#ifdef CONFIG_SECCOMP
unsigned int i = 0;
scmp_filter_ctx ctx;
ctx = seccomp_init(SCMP_ACT_KILL);
if (ctx == NULL) {
+ rc = -1;
goto seccomp_return;
}
@@ -251,5 +272,6 @@ int seccomp_start(void)
seccomp_return:
seccomp_release(ctx);
+#endif
return rc;
}
diff --git a/qemu-seccomp.h b/qemu-seccomp.h
index b2fc3f8..fa26d70 100644
--- a/qemu-seccomp.h
+++ b/qemu-seccomp.h
@@ -15,8 +15,17 @@
#ifndef QEMU_SECCOMP_H
#define QEMU_SECCOMP_H
+#ifdef CONFIG_SECCOMP
#include <seccomp.h>
-#include "osdep.h"
+#endif
+
+enum seccomp_states {
+ SECCOMP_OFF,
+ SECCOMP_ON
+};
+
+void seccomp_set_state(int);
+int seccomp_get_state(void);
+int seccomp_install_filter(void);
-int seccomp_start(void);
#endif
diff --git a/vl.c b/vl.c
index 4f03a72..cb3d85e 100644
--- a/vl.c
+++ b/vl.c
@@ -64,9 +64,7 @@
#include <linux/parport.h>
#endif
-#ifdef CONFIG_SECCOMP
#include "qemu-seccomp.h"
-#endif
#ifdef __sun__
#include <sys/stat.h>
@@ -772,22 +770,17 @@ static int bt_parse(const char *opt)
static int parse_sandbox(QemuOpts *opts, void *opaque)
{
- /* FIXME: change this to true for 1.3 */
- if (qemu_opt_get_bool(opts, "enable", false)) {
#ifdef CONFIG_SECCOMP
- if (seccomp_start() < 0) {
- qerror_report(ERROR_CLASS_GENERIC_ERROR,
- "failed to install seccomp syscall filter in the
kernel");
- return -1;
- }
-#else
- qerror_report(ERROR_CLASS_GENERIC_ERROR,
- "sandboxing request but seccomp is not compiled into
this build");
- return -1;
-#endif
+ /* seccomp sandboxing is on by default */
+ if (!qemu_opt_get_bool(opts, "enable", true)) {
+ seccomp_set_state(SECCOMP_OFF);
}
-
return 0;
+#else
+ fprintf(stderr, "sandbox option specified but seccomp is not compiled "
+ "into this build\n");
+ return -1;
+#endif
}
/*********QEMU USB setting******/
@@ -3489,6 +3482,14 @@ int main(int argc, char **argv, char **envp)
exit(1);
}
+ if (seccomp_get_state() == SECCOMP_ON) {
+ if (seccomp_install_filter() < 0) {
+ fprintf(stderr, "failed to install seccomp syscall "
+ "initialization filter\n");
+ exit(1);
+ }
+ }
+
#ifndef _WIN32
if (qemu_opts_foreach(qemu_find_opts("add-fd"), parse_add_fd, NULL, 1)) {
exit(1);
--
1.7.10.4
