[Top][All Lists]

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]

[Qemu-devel] [PATCH v4 0/4] seccomp fixes

From: Marc-André Lureau
Subject: [Qemu-devel] [PATCH v4 0/4] seccomp fixes
Date: Wed, 22 Aug 2018 19:02:46 +0200


This series fixes 2 issues with -sandbox:

- The seccomp action SCMP_ACT_KILL results in immediate termination of
  the thread that made the bad system call. However, qemu being
  multi-threaded, it keeps running. There is no easy way for parent
  process / management layer (libvirt) to know about that situation.

  Instead, the default SIGSYS handler when invoked with SCMP_ACT_TRAP
  will terminate the program and core dump.

  This may not be the most secure solution, but probably better than
  just killing the offending thread. SCMP_ACT_KILL_PROCESS has been
  added in Linux 4.14 to improve the situation, which I propose to use
  by default if available.

  Related to:

- The seccomp filter isn't applied to all threads. We can solve the
  issue by using SECCOMP_FILTER_FLAG_TSYNC since libseccomp 2.2.0 and
  kernel >= 3.17.

- modify qemu_seccomp() to set errno=ENOSYS
- add patch "seccomp: set the seccomp filter to all threads"

- fix clang unused inline warning
- add acked-by/r-b tags

Marc-André Lureau (4):
  seccomp: use SIGSYS signal instead of killing the thread
  seccomp: prefer SCMP_ACT_KILL_PROCESS if available
  configure: require libseccomp 2.2.0
  seccomp: set the seccomp filter to all threads

 qemu-seccomp.c | 36 +++++++++++++++++++++++++++++++++++-
 configure      |  7 ++-----
 2 files changed, 37 insertions(+), 6 deletions(-)


reply via email to

[Prev in Thread] Current Thread [Next in Thread]