On Fri, Sep 01, 2017 at 12:58:13PM +0200, Eduardo Otubo wrote:
> This patch changes the default behavior of the seccomp filter from
> whitelist to blacklist. By default now all system calls are allowed and
> a small black list of definitely forbidden ones was created.
>
> Signed-off-by: Eduardo Otubo <ot...@redhat.com>
> ---
> include/sysemu/seccomp.h | 2 +
> qemu-seccomp.c | 264
> ++++++-----------------------------------------
> vl.c | 1 -
> 3 files changed, 35 insertions(+), 232 deletions(-)
>
> diff --git a/include/sysemu/seccomp.h b/include/sysemu/seccomp.h
> index cfc06008cb..23b9c3c789 100644
> --- a/include/sysemu/seccomp.h
> +++ b/include/sysemu/seccomp.h
> + for (i = 0; i < ARRAY_SIZE(blacklist); i++) {
> + switch (blacklist[i].set) {
> + default:
> + goto add_syscall;
This goto rule is pointless - just use 'break'
> }
> - rc = seccomp_syscall_priority(ctx, seccomp_whitelist[i].num,
> - seccomp_whitelist[i].priority);
> +add_syscall:
> + rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, blacklist[i].num, 0);
> if (rc < 0) {
> goto seccomp_return;
> }
Regards,
Daniel
--
|: https://berrange.com -o- https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org -o- https://fstop138.berrange.com :|
|: https://entangle-photo.org -o- https://www.instagram.com/dberrange :|
