Re: [Qemu-devel] [PATCHv4 1/6] seccomp: changing from whitelist to blacklist

[Daniel P. Berrange]

On Fri, Sep 01, 2017 at 12:58:13PM +0200, Eduardo Otubo wrote:
> This patch changes the default behavior of the seccomp filter from
> whitelist to blacklist. By default now all system calls are allowed and
> a small black list of definitely forbidden ones was created.
> 
> Signed-off-by: Eduardo Otubo <address@hidden>
> ---
>  include/sysemu/seccomp.h |   2 +
>  qemu-seccomp.c           | 264 
> ++++++-----------------------------------------
>  vl.c                     |   1 -
>  3 files changed, 35 insertions(+), 232 deletions(-)
> 
> diff --git a/include/sysemu/seccomp.h b/include/sysemu/seccomp.h
> index cfc06008cb..23b9c3c789 100644
> --- a/include/sysemu/seccomp.h
> +++ b/include/sysemu/seccomp.h

> +    for (i = 0; i < ARRAY_SIZE(blacklist); i++) {
> +        switch (blacklist[i].set) {
> +        default:
> +            goto add_syscall;

This goto rule is pointless - just use 'break'

>          }
> -        rc = seccomp_syscall_priority(ctx, seccomp_whitelist[i].num,
> -                                      seccomp_whitelist[i].priority);
> +add_syscall:
> +        rc = seccomp_rule_add(ctx, SCMP_ACT_KILL, blacklist[i].num, 0);
>          if (rc < 0) {
>              goto seccomp_return;
>          }

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|