qom: Make info qom-tree sort children more efficiently
[qemu/armbru.git] / tools / virtiofsd / seccomp.c
blob3b1522acdd537885805f4aa47aeb4522cf2cc5e2
1 /*
2 * Seccomp sandboxing for virtiofsd
4 * Copyright (C) 2019 Red Hat, Inc.
6 * SPDX-License-Identifier: GPL-2.0-or-later
7 */
9 #include "qemu/osdep.h"
10 #include "seccomp.h"
11 #include "fuse_i.h"
12 #include "fuse_log.h"
13 #include <errno.h>
14 #include <glib.h>
15 #include <seccomp.h>
16 #include <stdlib.h>
18 /* Bodge for libseccomp 2.4.2 which broke ppoll */
19 #if !defined(__SNR_ppoll) && defined(__SNR_brk)
20 #ifdef __NR_ppoll
21 #define __SNR_ppoll __NR_ppoll
22 #else
23 #define __SNR_ppoll __PNR_ppoll
24 #endif
25 #endif
27 static const int syscall_whitelist[] = {
28 /* TODO ireg sem*() syscalls */
29 SCMP_SYS(brk),
30 SCMP_SYS(capget), /* For CAP_FSETID */
31 SCMP_SYS(capset),
32 SCMP_SYS(clock_gettime),
33 SCMP_SYS(clone),
34 #ifdef __NR_clone3
35 SCMP_SYS(clone3),
36 #endif
37 SCMP_SYS(close),
38 SCMP_SYS(copy_file_range),
39 SCMP_SYS(dup),
40 SCMP_SYS(eventfd2),
41 SCMP_SYS(exit),
42 SCMP_SYS(exit_group),
43 SCMP_SYS(fallocate),
44 SCMP_SYS(fchdir),
45 SCMP_SYS(fchmod),
46 SCMP_SYS(fchmodat),
47 SCMP_SYS(fchownat),
48 SCMP_SYS(fcntl),
49 SCMP_SYS(fdatasync),
50 SCMP_SYS(fgetxattr),
51 SCMP_SYS(flistxattr),
52 SCMP_SYS(flock),
53 SCMP_SYS(fremovexattr),
54 SCMP_SYS(fsetxattr),
55 SCMP_SYS(fstat),
56 SCMP_SYS(fstatfs),
57 SCMP_SYS(fsync),
58 SCMP_SYS(ftruncate),
59 SCMP_SYS(futex),
60 SCMP_SYS(getdents),
61 SCMP_SYS(getdents64),
62 SCMP_SYS(getegid),
63 SCMP_SYS(geteuid),
64 SCMP_SYS(getpid),
65 SCMP_SYS(gettid),
66 SCMP_SYS(gettimeofday),
67 SCMP_SYS(getxattr),
68 SCMP_SYS(linkat),
69 SCMP_SYS(listxattr),
70 SCMP_SYS(lseek),
71 SCMP_SYS(madvise),
72 SCMP_SYS(mkdirat),
73 SCMP_SYS(mknodat),
74 SCMP_SYS(mmap),
75 SCMP_SYS(mprotect),
76 SCMP_SYS(mremap),
77 SCMP_SYS(munmap),
78 SCMP_SYS(newfstatat),
79 SCMP_SYS(open),
80 SCMP_SYS(openat),
81 SCMP_SYS(ppoll),
82 SCMP_SYS(prctl), /* TODO restrict to just PR_SET_NAME? */
83 SCMP_SYS(preadv),
84 SCMP_SYS(pread64),
85 SCMP_SYS(pwritev),
86 SCMP_SYS(pwrite64),
87 SCMP_SYS(read),
88 SCMP_SYS(readlinkat),
89 SCMP_SYS(recvmsg),
90 SCMP_SYS(renameat),
91 SCMP_SYS(renameat2),
92 SCMP_SYS(removexattr),
93 SCMP_SYS(rt_sigaction),
94 SCMP_SYS(rt_sigprocmask),
95 SCMP_SYS(rt_sigreturn),
96 SCMP_SYS(sendmsg),
97 SCMP_SYS(setresgid),
98 SCMP_SYS(setresuid),
99 #ifdef __NR_setresgid32
100 SCMP_SYS(setresgid32),
101 #endif
102 #ifdef __NR_setresuid32
103 SCMP_SYS(setresuid32),
104 #endif
105 SCMP_SYS(set_robust_list),
106 SCMP_SYS(setxattr),
107 SCMP_SYS(symlinkat),
108 SCMP_SYS(time), /* Rarely needed, except on static builds */
109 SCMP_SYS(tgkill),
110 SCMP_SYS(unlinkat),
111 SCMP_SYS(unshare),
112 SCMP_SYS(utimensat),
113 SCMP_SYS(write),
114 SCMP_SYS(writev),
117 /* Syscalls used when --syslog is enabled */
118 static const int syscall_whitelist_syslog[] = {
119 SCMP_SYS(sendto),
122 static void add_whitelist(scmp_filter_ctx ctx, const int syscalls[], size_t len)
124 size_t i;
126 for (i = 0; i < len; i++) {
127 if (seccomp_rule_add(ctx, SCMP_ACT_ALLOW, syscalls[i], 0) != 0) {
128 fuse_log(FUSE_LOG_ERR, "seccomp_rule_add syscall %d failed\n",
129 syscalls[i]);
130 exit(1);
135 void setup_seccomp(bool enable_syslog)
137 scmp_filter_ctx ctx;
139 #ifdef SCMP_ACT_KILL_PROCESS
140 ctx = seccomp_init(SCMP_ACT_KILL_PROCESS);
141 /* Handle a newer libseccomp but an older kernel */
142 if (!ctx && errno == EOPNOTSUPP) {
143 ctx = seccomp_init(SCMP_ACT_TRAP);
145 #else
146 ctx = seccomp_init(SCMP_ACT_TRAP);
147 #endif
148 if (!ctx) {
149 fuse_log(FUSE_LOG_ERR, "seccomp_init() failed\n");
150 exit(1);
153 add_whitelist(ctx, syscall_whitelist, G_N_ELEMENTS(syscall_whitelist));
154 if (enable_syslog) {
155 add_whitelist(ctx, syscall_whitelist_syslog,
156 G_N_ELEMENTS(syscall_whitelist_syslog));
159 /* libvhost-user calls this for post-copy migration, we don't need it */
160 if (seccomp_rule_add(ctx, SCMP_ACT_ERRNO(ENOSYS),
161 SCMP_SYS(userfaultfd), 0) != 0) {
162 fuse_log(FUSE_LOG_ERR, "seccomp_rule_add userfaultfd failed\n");
163 exit(1);
166 if (seccomp_load(ctx) < 0) {
167 fuse_log(FUSE_LOG_ERR, "seccomp_load() failed\n");
168 exit(1);
171 seccomp_release(ctx);