On Sat, Mar 31, 2018 at 10:15:03PM +0200, Ján Tomko wrote: > If QEMU uses a seccomp blacklist (since 2.11), -sandbox on > no longer tries to whitelist all the calls, but uses sets > of blacklists: > default (always blacklisted with -sandbox on) > obsolete (defaults to deny) Perhaps list that anyway, so we don't rely on defaults. > elevateprivileges (setuid & co, default: allow) > spwan (fork & execve, default: allow) s/spwan/spawn/ > resourcecontrol (setaffinity, setscheduler, default: allow) I'm thinking we should blacklist resourcecontrol too perhaps, since libvirt should be applying affinity/sched params itself. > > If these are supported, default to sandbox with spawn and > elevateprivileges blacklisted. > > https://bugzilla.redhat.com/show_bug.cgi?id=1492597 > > Signed-off-by: Ján Tomko <jtomko@xxxxxxxxxx> > --- > src/qemu/qemu_command.c | 10 +++++++-- > tests/qemuxml2argvdata/minimal-sandbox.args | 25 +++++++++++++++++++++ > tests/qemuxml2argvdata/minimal-sandbox.xml | 34 +++++++++++++++++++++++++++++ > tests/qemuxml2argvtest.c | 3 +++ > 4 files changed, 70 insertions(+), 2 deletions(-) > create mode 100644 tests/qemuxml2argvdata/minimal-sandbox.args > create mode 100644 tests/qemuxml2argvdata/minimal-sandbox.xml > > diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c > index 89fd08b64..3388f861a 100644 > --- a/src/qemu/qemu_command.c > +++ b/src/qemu/qemu_command.c > @@ -10211,10 +10211,16 @@ qemuBuildCommandLine(virQEMUDriverPtr driver, > } > > if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX)) { > - if (cfg->seccompSandbox == 0) > + if (cfg->seccompSandbox == 0) { > virCommandAddArgList(cmd, "-sandbox", "off", NULL); > - else if (cfg->seccompSandbox > 0) > + } else if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_BLACKLIST) && > + cfg->seccompSandbox != 0) { Ok this relies on fact that seccompSandbox defaults to '-1' if not present in the config file, or can be set to 1 by the user. > + virCommandAddArgList(cmd, "-sandbox", > + "on,elevateprivileges=deny,spawn=deny", NULL); > + /* obsolete=deny, resourcecontrol=allow */ Yes, I'd suggest we add these too > + } else if (cfg->seccompSandbox > 0) { So this is unreachable with new qemu > virCommandAddArgList(cmd, "-sandbox", "on", NULL); > + } > } else if (cfg->seccompSandbox > 0) { > virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s", > _("QEMU does not support seccomp sandboxes")); > diff --git a/tests/qemuxml2argvdata/minimal-sandbox.args b/tests/qemuxml2argvdata/minimal-sandbox.args > new file mode 100644 > index 000000000..285cfed70 > --- /dev/null > +++ b/tests/qemuxml2argvdata/minimal-sandbox.args > @@ -0,0 +1,25 @@ > +LC_ALL=C \ > +PATH=/bin \ > +HOME=/home/test \ > +USER=test \ > +LOGNAME=test \ > +QEMU_AUDIO_DRV=none \ > +/usr/bin/qemu-system-i686 \ > +-name QEMUGuest1 \ > +-S \ > +-M pc \ > +-m 214 \ > +-smp 1,sockets=1,cores=1,threads=1 \ > +-uuid c7a5fdbd-edaf-9455-926a-d65c16db1809 \ > +-nographic \ > +-nodefaults \ > +-chardev socket,id=charmonitor,path=/tmp/lib/domain--1-QEMUGuest1/monitor.sock,\ > +server,nowait \ > +-mon chardev=charmonitor,id=monitor,mode=readline \ > +-no-acpi \ > +-boot c \ > +-usb \ > +-drive file=/dev/HostVG/QEMUGuest1,format=raw,if=none,id=drive-ide0-0-0 \ > +-device ide-drive,bus=ide.0,unit=0,drive=drive-ide0-0-0,id=ide0-0-0 \ > +-device virtio-balloon-pci,id=balloon0,bus=pci.0,addr=0x3 \ > +-sandbox on,elevateprivileges=deny,spawn=deny > diff --git a/tests/qemuxml2argvdata/minimal-sandbox.xml b/tests/qemuxml2argvdata/minimal-sandbox.xml > new file mode 100644 > index 000000000..9ef92f8fe > --- /dev/null > +++ b/tests/qemuxml2argvdata/minimal-sandbox.xml > @@ -0,0 +1,34 @@ > +<domain type='qemu'> > + <name>QEMUGuest1</name> > + <uuid>c7a5fdbd-edaf-9455-926a-d65c16db1809</uuid> > + <title>A description of the test machine.</title> > + <description> > + A test of qemu's minimal configuration. > + This test also tests the description and title elements. > + </description> > + <memory unit='KiB'>219100</memory> > + <currentMemory unit='KiB'>219100</currentMemory> > + <vcpu placement='static' cpuset='1-4,8-20,525'>1</vcpu> > + <os> > + <type arch='i686' machine='pc'>hvm</type> > + <boot dev='hd'/> > + </os> > + <clock offset='utc'/> > + <on_poweroff>destroy</on_poweroff> > + <on_reboot>restart</on_reboot> > + <on_crash>destroy</on_crash> > + <devices> > + <emulator>/usr/bin/qemu-system-i686</emulator> > + <disk type='block' device='disk'> > + <source dev='/dev/HostVG/QEMUGuest1'/> > + <target dev='hda' bus='ide'/> > + <address type='drive' controller='0' bus='0' target='0' unit='0'/> > + </disk> > + <controller type='usb' index='0'/> > + <controller type='ide' index='0'/> > + <controller type='pci' index='0' model='pci-root'/> > + <input type='mouse' bus='ps2'/> > + <input type='keyboard' bus='ps2'/> > + <memballoon model='virtio'/> > + </devices> > +</domain> > diff --git a/tests/qemuxml2argvtest.c b/tests/qemuxml2argvtest.c > index 308d71f72..5fb16987f 100644 > --- a/tests/qemuxml2argvtest.c > +++ b/tests/qemuxml2argvtest.c > @@ -691,6 +691,9 @@ mymain(void) > unsetenv("SDL_AUDIODRIVER"); > > DO_TEST("minimal", NONE); > + DO_TEST("minimal-sandbox", > + QEMU_CAPS_SECCOMP_SANDBOX, > + QEMU_CAPS_SECCOMP_BLACKLIST); > DO_TEST_PARSE_ERROR("minimal-no-memory", NONE); > DO_TEST("minimal-msg-timestamp", QEMU_CAPS_MSG_TIMESTAMP); > DO_TEST("machine-aliases1", NONE); > -- > 2.13.6 > > -- > libvir-list mailing list > libvir-list@xxxxxxxxxx > https://www.redhat.com/mailman/listinfo/libvir-list Regards, Daniel -- |: https://berrange.com -o- https://www.flickr.com/photos/dberrange :| |: https://libvirt.org -o- https://fstop138.berrange.com :| |: https://entangle-photo.org -o- https://www.instagram.com/dberrange :| -- libvir-list mailing list libvir-list@xxxxxxxxxx https://www.redhat.com/mailman/listinfo/libvir-list
