Skip to contentSkip to conversation

seccomp: add mbind() to the syscall whitelist

PATCH In review Paul Moore 3 participants 3 messages Dec 17, 2014 – Dec 18, 2014

lore
Share & tools
lore

Paul Moore

author
#0 lore raw

PATCH 1/1 seccomp: add mbind() to the syscall whitelist

The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to set the policy for a memory range. Add the syscall to the seccomp sandbox whitelist.

Signed-off-by Paul Moore <[email protected]>
---
 qemu-seccomp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
qemu-seccomp.c +2 -1
index af6a375..b0c6269 100644
@@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(fallocate), 240 },
     { SCMP_SYS(fadvise64), 240 },
     { SCMP_SYS(inotify_init1), 240 },
-    { SCMP_SYS(inotify_add_watch), 240 }
+    { SCMP_SYS(inotify_add_watch), 240 },
+    { SCMP_SYS(mbind), 240 }
 };
 
 int seccomp_start(void)
Tested-by Reviewed-by on v1 1/1
#1 lore raw
Quoted 5 lines · Paul Moore

The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to set the policy for a memory range. Add the syscall to the seccomp sandbox whitelist.

Signed-off-by Paul Moore <[email protected]>
Tested-by Eduardo Habkost <[email protected]>
Reviewed-by Eduardo Habkost <[email protected]>
Quoted 20 lines
---
 qemu-seccomp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
qemu-seccomp.c +2 -1
index af6a375..b0c6269 100644
@@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(fallocate), 240 },
     { SCMP_SYS(fadvise64), 240 },
     { SCMP_SYS(inotify_init1), 240 },
-    { SCMP_SYS(inotify_add_watch), 240 }
+    { SCMP_SYS(inotify_add_watch), 240 },
+    { SCMP_SYS(mbind), 240 }
 };
 
 int seccomp_start(void)
Signature · 1 line
Eduardo
Acked-by on v1 1/1
#2 lore raw
In reply to Paul Moore
Quoted 15 lines · Paul Moore

The "memory-backend-ram" QOM object utilizes the mbind(2) syscall to set the policy for a memory range. Add the syscall to the seccomp sandbox whitelist.

Signed-off-by Paul Moore <[email protected]>
---
 qemu-seccomp.c |    3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)
qemu-seccomp.c +0 -0
index af6a375..b0c6269 100644

qemu-seccomp.c static const struct QemuSeccompSyscall seccomp_whitelist[] = { · line 242

Quoted 9 lines
qemu-seccomp.c +2 -1
@@ -235,7 +235,8 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
     { SCMP_SYS(fallocate), 240 },
     { SCMP_SYS(fadvise64), 240 },
     { SCMP_SYS(inotify_init1), 240 },
-    { SCMP_SYS(inotify_add_watch), 240 }
+    { SCMP_SYS(inotify_add_watch), 240 },
+    { SCMP_SYS(mbind), 240 }
 };
 
 int seccomp_start(void)
Acked-by Eduardo Otubo <[email protected]>

I have a minor fix already in plan, so I'll do a pull request tomorrow by the end of the day.

Thanks for the patch.

Signature · 2 lines
Eduardo Otubo
ProfitBricks GmbH