2 * Seccomp sandboxing for virtiofsd
4 * Copyright (C) 2019 Red Hat, Inc.
6 * SPDX-License-Identifier: GPL-2.0-or-later
9 #include "qemu/osdep.h"
18 /* Bodge for libseccomp 2.4.2 which broke ppoll */
19 #if !defined(__SNR_ppoll) && defined(__SNR_brk)
21 #define __SNR_ppoll __NR_ppoll
23 #define __SNR_ppoll __PNR_ppoll
27 static const int syscall_whitelist
[] = {
28 /* TODO ireg sem*() syscalls */
30 SCMP_SYS(capget
), /* For CAP_FSETID */
32 SCMP_SYS(clock_gettime
),
38 SCMP_SYS(copy_file_range
),
53 SCMP_SYS(fremovexattr
),
66 SCMP_SYS(gettimeofday
),
82 SCMP_SYS(prctl
), /* TODO restrict to just PR_SET_NAME? */
92 SCMP_SYS(removexattr
),
93 SCMP_SYS(rt_sigaction
),
94 SCMP_SYS(rt_sigprocmask
),
95 SCMP_SYS(rt_sigreturn
),
99 #ifdef __NR_setresgid32
100 SCMP_SYS(setresgid32
),
102 #ifdef __NR_setresuid32
103 SCMP_SYS(setresuid32
),
105 SCMP_SYS(set_robust_list
),
108 SCMP_SYS(time
), /* Rarely needed, except on static builds */
117 /* Syscalls used when --syslog is enabled */
118 static const int syscall_whitelist_syslog
[] = {
122 static void add_whitelist(scmp_filter_ctx ctx
, const int syscalls
[], size_t len
)
126 for (i
= 0; i
< len
; i
++) {
127 if (seccomp_rule_add(ctx
, SCMP_ACT_ALLOW
, syscalls
[i
], 0) != 0) {
128 fuse_log(FUSE_LOG_ERR
, "seccomp_rule_add syscall %d failed\n",
135 void setup_seccomp(bool enable_syslog
)
139 #ifdef SCMP_ACT_KILL_PROCESS
140 ctx
= seccomp_init(SCMP_ACT_KILL_PROCESS
);
141 /* Handle a newer libseccomp but an older kernel */
142 if (!ctx
&& errno
== EOPNOTSUPP
) {
143 ctx
= seccomp_init(SCMP_ACT_TRAP
);
146 ctx
= seccomp_init(SCMP_ACT_TRAP
);
149 fuse_log(FUSE_LOG_ERR
, "seccomp_init() failed\n");
153 add_whitelist(ctx
, syscall_whitelist
, G_N_ELEMENTS(syscall_whitelist
));
155 add_whitelist(ctx
, syscall_whitelist_syslog
,
156 G_N_ELEMENTS(syscall_whitelist_syslog
));
159 /* libvhost-user calls this for post-copy migration, we don't need it */
160 if (seccomp_rule_add(ctx
, SCMP_ACT_ERRNO(ENOSYS
),
161 SCMP_SYS(userfaultfd
), 0) != 0) {
162 fuse_log(FUSE_LOG_ERR
, "seccomp_rule_add userfaultfd failed\n");
166 if (seccomp_load(ctx
) < 0) {
167 fuse_log(FUSE_LOG_ERR
, "seccomp_load() failed\n");
171 seccomp_release(ctx
);