[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
Re: [Qemu-devel] [PATCH] Add a few argument filters to the seccomp sandb
From: |
Paul Moore |
Subject: |
Re: [Qemu-devel] [PATCH] Add a few argument filters to the seccomp sandbox |
Date: |
Fri, 11 Sep 2015 14:58:56 -0400 |
User-agent: |
KMail/4.14.10 (Linux/4.1.5-gentoo; KDE/4.14.11; x86_64; ; ) |
On Thursday, September 10, 2015 03:48:52 PM Daniel P. Berrange wrote:
> On Wed, Sep 09, 2015 at 09:55:33PM -0400, address@hidden wrote:
> > +
> > + /* shmget */
> > + rc = seccomp_rule_add(ctx, SCMP_ACT_ALLOW, SCMP_SYS(shmget), 2,
> > + SCMP_A0(SCMP_CMP_EQ, IPC_PRIVATE),
> > + SCMP_A2(SCMP_CMP_EQ, IP_CREAT|0777));
>
> I'm not familiar with semantics of these seccomp rules, but is this
> saying that the second arg must be exactly equal to IP_CREAT|0777 ?
Yes.
> If the app passes IP_CREAT|0600, would that be permitted instead ?
> The latter is what I see gtk2 source code passing for mode.
It wouldn't match the rule as written above, if it doesn't match any other
configured rules it would hit the default filter action.
--
paul moore
security @ redhat