If CONFIG_SECCOMP is undefined, the option 'elevateprivileges' remains compiled. This would make libvirt set the corresponding capability and then trigger failure during guest startup. This patch moves the code regarding seccomp command line options to qemu-seccomp.c file and wraps qemu_opts_foreach finding sandbox option with CONFIG_SECCOMP. Because parse_sandbox() is moved into qemu-seccomp.c file, change seccomp_start() to static function. Signed-off-by: Yi Min Zhao <zyimin@linux.ibm.com> Reviewed-by: Ján Tomko <jtomko@redhat.com> Tested-by: Ján Tomko <jtomko@redhat.com> Acked-by: Eduardo Otubo <otubo@redhat.com> Message-Id: <20180531032937.1925-1-zyimin@linux.ibm.com> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
247 lines
9 KiB
C
247 lines
9 KiB
C
/*
|
|
* QEMU seccomp mode 2 support with libseccomp
|
|
*
|
|
* Copyright IBM, Corp. 2012
|
|
*
|
|
* Authors:
|
|
* Eduardo Otubo <eotubo@br.ibm.com>
|
|
*
|
|
* This work is licensed under the terms of the GNU GPL, version 2. See
|
|
* the COPYING file in the top-level directory.
|
|
*
|
|
* Contributions after 2012-01-13 are licensed under the terms of the
|
|
* GNU GPL, version 2 or (at your option) any later version.
|
|
*/
|
|
#include "qemu/osdep.h"
|
|
#include "qemu/config-file.h"
|
|
#include "qemu/option.h"
|
|
#include "qemu/module.h"
|
|
#include "qemu/error-report.h"
|
|
#include <sys/prctl.h>
|
|
#include <seccomp.h>
|
|
#include "sysemu/seccomp.h"
|
|
|
|
/* For some architectures (notably ARM) cacheflush is not supported until
|
|
* libseccomp 2.2.3, but configure enforces that we are using a more recent
|
|
* version on those hosts, so it is OK for this check to be less strict.
|
|
*/
|
|
#if SCMP_VER_MAJOR >= 3
|
|
#define HAVE_CACHEFLUSH
|
|
#elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 2
|
|
#define HAVE_CACHEFLUSH
|
|
#endif
|
|
|
|
struct QemuSeccompSyscall {
|
|
int32_t num;
|
|
uint8_t set;
|
|
};
|
|
|
|
static const struct QemuSeccompSyscall blacklist[] = {
|
|
/* default set of syscalls to blacklist */
|
|
{ SCMP_SYS(reboot), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(swapon), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(swapoff), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(syslog), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(mount), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(umount), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(kexec_load), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(afs_syscall), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(break), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(ftime), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(getpmsg), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(gtty), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(lock), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(mpx), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(prof), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(profil), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(putpmsg), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(security), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(stty), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(tuxcall), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(ulimit), QEMU_SECCOMP_SET_DEFAULT },
|
|
{ SCMP_SYS(vserver), QEMU_SECCOMP_SET_DEFAULT },
|
|
/* obsolete */
|
|
{ SCMP_SYS(readdir), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(_sysctl), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(bdflush), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(create_module), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(get_kernel_syms), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(query_module), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(sgetmask), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(ssetmask), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(sysfs), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(uselib), QEMU_SECCOMP_SET_OBSOLETE },
|
|
{ SCMP_SYS(ustat), QEMU_SECCOMP_SET_OBSOLETE },
|
|
/* privileged */
|
|
{ SCMP_SYS(setuid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setgid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setpgid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setsid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setreuid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setregid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setresuid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setresgid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setfsuid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
{ SCMP_SYS(setfsgid), QEMU_SECCOMP_SET_PRIVILEGED },
|
|
/* spawn */
|
|
{ SCMP_SYS(fork), QEMU_SECCOMP_SET_SPAWN },
|
|
{ SCMP_SYS(vfork), QEMU_SECCOMP_SET_SPAWN },
|
|
{ SCMP_SYS(execve), QEMU_SECCOMP_SET_SPAWN },
|
|
/* resource control */
|
|
{ SCMP_SYS(getpriority), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(setpriority), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_setparam), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_getparam), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_setscheduler), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_getscheduler), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_setaffinity), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_getaffinity), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_get_priority_max), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
{ SCMP_SYS(sched_get_priority_min), QEMU_SECCOMP_SET_RESOURCECTL },
|
|
};
|
|
|
|
|
|
static int seccomp_start(uint32_t seccomp_opts)
|
|
{
|
|
int rc = 0;
|
|
unsigned int i = 0;
|
|
scmp_filter_ctx ctx;
|
|
|
|
ctx = seccomp_init(SCMP_ACT_ALLOW);
|
|
if (ctx == NULL) {
|
|
rc = -1;
|
|
goto seccomp_return;
|
|
}
|
|
|
|
for (i = 0; i < ARRAY_SIZE(blacklist); i++) {
|
|
if (!(seccomp_opts & blacklist[i].set)) {
|
|
continue;
|
|
}
|
|
|
|
rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, blacklist[i].num, 0);
|
|
if (rc < 0) {
|
|
goto seccomp_return;
|
|
}
|
|
}
|
|
|
|
rc = seccomp_load(ctx);
|
|
|
|
seccomp_return:
|
|
seccomp_release(ctx);
|
|
return rc;
|
|
}
|
|
|
|
#ifdef CONFIG_SECCOMP
|
|
int parse_sandbox(void *opaque, QemuOpts *opts, Error **errp)
|
|
{
|
|
if (qemu_opt_get_bool(opts, "enable", false)) {
|
|
uint32_t seccomp_opts = QEMU_SECCOMP_SET_DEFAULT
|
|
| QEMU_SECCOMP_SET_OBSOLETE;
|
|
const char *value = NULL;
|
|
|
|
value = qemu_opt_get(opts, "obsolete");
|
|
if (value) {
|
|
if (g_str_equal(value, "allow")) {
|
|
seccomp_opts &= ~QEMU_SECCOMP_SET_OBSOLETE;
|
|
} else if (g_str_equal(value, "deny")) {
|
|
/* this is the default option, this if is here
|
|
* to provide a little bit of consistency for
|
|
* the command line */
|
|
} else {
|
|
error_report("invalid argument for obsolete");
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
value = qemu_opt_get(opts, "elevateprivileges");
|
|
if (value) {
|
|
if (g_str_equal(value, "deny")) {
|
|
seccomp_opts |= QEMU_SECCOMP_SET_PRIVILEGED;
|
|
} else if (g_str_equal(value, "children")) {
|
|
seccomp_opts |= QEMU_SECCOMP_SET_PRIVILEGED;
|
|
|
|
/* calling prctl directly because we're
|
|
* not sure if host has CAP_SYS_ADMIN set*/
|
|
if (prctl(PR_SET_NO_NEW_PRIVS, 1)) {
|
|
error_report("failed to set no_new_privs "
|
|
"aborting");
|
|
return -1;
|
|
}
|
|
} else if (g_str_equal(value, "allow")) {
|
|
/* default value */
|
|
} else {
|
|
error_report("invalid argument for elevateprivileges");
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
value = qemu_opt_get(opts, "spawn");
|
|
if (value) {
|
|
if (g_str_equal(value, "deny")) {
|
|
seccomp_opts |= QEMU_SECCOMP_SET_SPAWN;
|
|
} else if (g_str_equal(value, "allow")) {
|
|
/* default value */
|
|
} else {
|
|
error_report("invalid argument for spawn");
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
value = qemu_opt_get(opts, "resourcecontrol");
|
|
if (value) {
|
|
if (g_str_equal(value, "deny")) {
|
|
seccomp_opts |= QEMU_SECCOMP_SET_RESOURCECTL;
|
|
} else if (g_str_equal(value, "allow")) {
|
|
/* default value */
|
|
} else {
|
|
error_report("invalid argument for resourcecontrol");
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
if (seccomp_start(seccomp_opts) < 0) {
|
|
error_report("failed to install seccomp syscall filter "
|
|
"in the kernel");
|
|
return -1;
|
|
}
|
|
}
|
|
|
|
return 0;
|
|
}
|
|
|
|
static QemuOptsList qemu_sandbox_opts = {
|
|
.name = "sandbox",
|
|
.implied_opt_name = "enable",
|
|
.head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head),
|
|
.desc = {
|
|
{
|
|
.name = "enable",
|
|
.type = QEMU_OPT_BOOL,
|
|
},
|
|
{
|
|
.name = "obsolete",
|
|
.type = QEMU_OPT_STRING,
|
|
},
|
|
{
|
|
.name = "elevateprivileges",
|
|
.type = QEMU_OPT_STRING,
|
|
},
|
|
{
|
|
.name = "spawn",
|
|
.type = QEMU_OPT_STRING,
|
|
},
|
|
{
|
|
.name = "resourcecontrol",
|
|
.type = QEMU_OPT_STRING,
|
|
},
|
|
{ /* end of list */ }
|
|
},
|
|
};
|
|
|
|
static void seccomp_register(void)
|
|
{
|
|
qemu_add_opts(&qemu_sandbox_opts);
|
|
}
|
|
opts_init(seccomp_register);
|
|
#endif
|