On Tue, Oct 22, 2013 at 12:21 PM, Eduardo Otubo
<ot...@linux.vnet.ibm.com> wrote:
> Inverting the way sandbox handles arguments, making possible to have no
> argument and still have '-sandbox on' enabled.
>
> Signed-off-by: Eduardo Otubo <ot...@linux.vnet.ibm.com>
> ---
>
> The option '-sandbox on' is now used by default by virt-test[0] -- it has been
> merged into the 'next' branch and will be available in the next release,
> meaning we have a back support for regression tests if anything breaks because
> of some missing system call not listed in the whitelist.
>
> This being said, I think it makes sense to have this option set to 'on' by
> default in the next Qemu version. It's been a while since no missing syscall
> is
> reported and at this point the whitelist seems to be pretty mature.
>
> [0] -
> https://github.com/autotest/virt-test/commit/50e1f7d47a94f4c770880cd8ec0f18365dcba714
This breaks hot_add of a network device that uses a script= argument, correct?
If so, this cannot be made default.
Regards,
Anthony Liguori
>
> qemu-options.hx | 4 ++--
> vl.c | 47 ++++++++++++++++++++++++++++-------------------
> 2 files changed, 30 insertions(+), 21 deletions(-)
>
> diff --git a/qemu-options.hx b/qemu-options.hx
> index 5dc8b75..315a86d 100644
> --- a/qemu-options.hx
> +++ b/qemu-options.hx
> @@ -2982,13 +2982,13 @@ Old param mode (ARM only).
> ETEXI
>
> DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \
> - "-sandbox <arg> Enable seccomp mode 2 system call filter (default
> 'off').\n",
> + "-sandbox <arg> Enable seccomp mode 2 system call filter (default
> 'on').\n",
> QEMU_ARCH_ALL)
> STEXI
> @item -sandbox @var{arg}
> @findex -sandbox
> Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering
> and 'off' will
> -disable it. The default is 'off'.
> +disable it. The default is 'on'.
> ETEXI
>
> DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig,
> diff --git a/vl.c b/vl.c
> index b42ac67..ae3bdc9 100644
> --- a/vl.c
> +++ b/vl.c
> @@ -529,6 +529,20 @@ static QemuOptsList qemu_msg_opts = {
> },
> };
>
> +static QemuOpts *qemu_get_sandbox_opts(void)
> +{
> + QemuOptsList *list;
> + QemuOpts *opts;
> +
> + list = qemu_find_opts("sandbox");
> + assert(list);
> + opts = qemu_opts_find(list, NULL);
> + if (!opts) {
> + opts = qemu_opts_create_nofail(list);
> + }
> + return opts;
> +}
> +
> /**
> * Get machine options
> *
> @@ -960,24 +974,9 @@ static int bt_parse(const char *opt)
> return 1;
> }
>
> -static int parse_sandbox(QemuOpts *opts, void *opaque)
> +static bool sandbox_enabled(bool default_usb)
> {
> - /* FIXME: change this to true for 1.3 */
> - if (qemu_opt_get_bool(opts, "enable", false)) {
> -#ifdef CONFIG_SECCOMP
> - if (seccomp_start() < 0) {
> - qerror_report(ERROR_CLASS_GENERIC_ERROR,
> - "failed to install seccomp syscall filter in the
> kernel");
> - return -1;
> - }
> -#else
> - qerror_report(ERROR_CLASS_GENERIC_ERROR,
> - "sandboxing request but seccomp is not compiled into
> this build");
> - return -1;
> -#endif
> - }
> -
> - return 0;
> + return qemu_opt_get_bool(qemu_get_sandbox_opts(), "sandbox",
> default_usb);
> }
>
> bool usb_enabled(bool default_usb)
> @@ -3806,8 +3805,18 @@ int main(int argc, char **argv, char **envp)
> exit(1);
> }
>
> - if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL,
> 0)) {
> - exit(1);
> + if (sandbox_enabled(true)) {
> +#ifdef CONFIG_SECCOMP
> + if (seccomp_start() < 0) {
> + qerror_report(ERROR_CLASS_GENERIC_ERROR,
> + "failed to install seccomp syscall filter in the
> kernel");
> + return -1;
> + }
> +#else
> + qerror_report(ERROR_CLASS_GENERIC_ERROR,
> + "sandboxing request but seccomp is not compiled into
> this build");
> + return -1;
> +#endif
> }
>
> #ifndef _WIN32
> --
> 1.8.3.1
>
