Skip to contentSkip to conversation

seccomp: add getrusage() to the syscall whitelist for Open vSwitch

PATCH NAK Paul Moore 2 participants 2 messages Mar 6, 2014

lore
Share & tools
lore

Paul Moore

author
#0 lore raw

PATCH 1/1 seccomp: add getrusage() to the syscall whitelist for Open vSwitch

When QEMU is used with Open vSwitch it is common to create netdev script and downscript scripts that use the ovs-vsctl command to manage the underlying network devices. Unfortunately, ovs-vsctl calls the getrusage() syscall which is not currently present in the QEMU/seccomp whistelist.

Signed-off-by Paul Moore <[email protected]>
---
 qemu-seccomp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
qemu-seccomp.c +2 -1
index caa926e..86210a4 100644
@@ -225,7 +225,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(fchmod), 240 },
     { SCMP_SYS(shmget), 240 },
     { SCMP_SYS(shmat), 240 },
-    { SCMP_SYS(shmdt), 240 }
+    { SCMP_SYS(shmdt), 240 },
+    { SCMP_SYS(getrusage), 240 }
 };
 
 int seccomp_start(void)
NAK
#1 lore raw

Il 06/03/2014 15:50, Paul Moore ha scritto:

Quoted 19 lines

When QEMU is used with Open vSwitch it is common to create netdev script and downscript scripts that use the ovs-vsctl command to manage the underlying network devices. Unfortunately, ovs-vsctl calls the getrusage() syscall which is not currently present in the QEMU/seccomp whistelist.

Signed-off-by Paul Moore <[email protected]>
---
 qemu-seccomp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
qemu-seccomp.c +0 -0
index caa926e..86210a4 100644

qemu-seccomp.c static const struct QemuSeccompSyscall seccomp_whitelist[] = { · line 232

Quoted 9 lines
qemu-seccomp.c +2 -1
@@ -225,7 +225,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(fchmod), 240 },
     { SCMP_SYS(shmget), 240 },
     { SCMP_SYS(shmat), 240 },
-    { SCMP_SYS(shmdt), 240 }
+    { SCMP_SYS(shmdt), 240 },
+    { SCMP_SYS(getrusage), 240 }
 };
 
 int seccomp_start(void)

NACK, when QEMU is used in sandbox mode you should use file descriptor passing instead.

Paolo