[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for
From: |
Daniel P. Berrange |
Subject: |
Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist |
Date: |
Tue, 17 Sep 2013 14:06:06 +0100 |
User-agent: |
Mutt/1.5.21 (2010-09-15) |
On Tue, Sep 17, 2013 at 10:01:23AM -0300, Eduardo Otubo wrote:
>
>
> On 09/11/2013 01:49 PM, Daniel P. Berrange wrote:
> >On Wed, Sep 11, 2013 at 12:45:54PM -0400, Corey Bryant wrote:
> >>
> >>
> >>On 09/06/2013 03:21 PM, Eduardo Otubo wrote:
> >>>New command line options for the seccomp blacklist feature:
> >>>
> >>> $ qemu -sandbox on[,strict=<on|off>]
> >>>
> >>>The strict parameter will turn on or off the new system call blacklist
> >>
> >>I mentioned this before but I'll say it again since I think it needs
> >>to be discussed. Since this regresses support (it'll prevent -net
> >>bridge and -net tap from using execv) the concern I have with the
> >>strict=on|off option is whether or not we will have the flexibility
> >>to modify the blacklist once QEMU is released with this support. Of
> >>course we should be able to add more syscalls to the blacklist as
> >>long as they don't regress QEMU functionality. But if we want to
> >>add a syscall that does regress QEMU functionality, I think we'd
> >>have to add a new command line option, which doesn't seem desirable.
> >>
> >>So a more flexible approach may be necessary. Maybe the blacklist
> >>should be passed on the command line, which would enable it to be
> >>defined by libvirt and passed to QEMU. I know Paul is working on
> >>something for libvirt so maybe that answers this question.
>
> Paul, what exactly are you planning to add to libvirt? I'm not a big
> fan of using qemu command line to pass syscalls for blacklist as
> arguments, but I can't see other way to avoid problems (like -net
> bridge / -net tap) from happening.
IMHO, if libvirt is enabling seccomp, then making all possible cli
args work is a non-goal. If there are things which require privileges
seccomp is blocking, then libvirt should avoid using them. eg by making
use of FD passing where appropriate to reduce privileges qemu needs.
Daniel
--
|: http://berrange.com -o- http://www.flickr.com/photos/dberrange/ :|
|: http://libvirt.org -o- http://virt-manager.org :|
|: http://autobuild.org -o- http://search.cpan.org/~danberr/ :|
|: http://entangle-photo.org -o- http://live.gnome.org/gtk-vnc :|
- [Qemu-devel] [PATCHv2 0/3] seccomp: adding blacklist support with command line, Eduardo Otubo, 2013/09/06
- [Qemu-devel] [PATCHv3 3/3] seccomp: general fixes, Eduardo Otubo, 2013/09/06
- [Qemu-devel] [PATCHv2 1/3] seccomp: adding blacklist support, Eduardo Otubo, 2013/09/06
- [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Eduardo Otubo, 2013/09/06
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Corey Bryant, 2013/09/11
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Daniel P. Berrange, 2013/09/11
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Eduardo Otubo, 2013/09/17
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist,
Daniel P. Berrange <=
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Paul Moore, 2013/09/17
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Eduardo Otubo, 2013/09/17
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Eduardo Otubo, 2013/09/17
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Corey Bryant, 2013/09/17
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Eduardo Otubo, 2013/09/17
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Daniel P. Berrange, 2013/09/18
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Paul Moore, 2013/09/18
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Daniel P. Berrange, 2013/09/18
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Paul Moore, 2013/09/18
- Re: [Qemu-devel] [PATCHv2 2/3] seccomp: adding command line support for blacklist, Daniel P. Berrange, 2013/09/18