QEMU/seccomp fixes for PulseAudio
cover QEMU/seccomp fixes for PulseAudio
It turns out we need to add some additional syscalls to QEMU to make PulseAudio happy. Two minor patches follow ...
---
Paul Moore (2):
seccomp: add mkdir() and fchmod() to the whitelist
seccomp: add some basic shared memory syscalls to the whitelist
qemu-seccomp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
PATCH 1/2 seccomp: add mkdir() and fchmod() to the whitelist
The PulseAudio library attempts to do a mkdir(2) and fchmod(2) on "/run/user/<UID>/pulse" which is currently blocked by the syscall filter; this patch adds the two missing syscalls to the whitelist. You can reproduce this problem with the following command:
# qemu -monitor stdio -device intel-hda -device hda-duplex
If watched under strace the following syscalls are shown:
mkdir("/run/user/0/pulse", 0700)
fchmod(11, 0700) [NOTE: 11 is the fd for /run/user/0/pulse]
--- qemu-seccomp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)
qemu-seccomp.c +3 -1
@@ -220,7 +220,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(io_cancel), 241 }, { SCMP_SYS(io_setup), 241 }, { SCMP_SYS(io_destroy), 241 }, - { SCMP_SYS(arch_prctl), 240 } + { SCMP_SYS(arch_prctl), 240 }, + { SCMP_SYS(mkdir), 240 }, + { SCMP_SYS(fchmod), 240 } };int seccomp_start (void )
PATCH 2/2 seccomp: add some basic shared memory syscalls to the whitelist
In reply to Paul MoorePulseAudio requires the use of shared memory so add shmget(), shmat(), and shmdt() to the syscall whitelist.
--- qemu-seccomp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)
qemu-seccomp.c +4 -1
@@ -222,7 +222,10 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(io_destroy), 241 }, { SCMP_SYS(arch_prctl), 240 }, { SCMP_SYS(mkdir), 240 }, - { SCMP_SYS(fchmod), 240 } + { SCMP_SYS(fchmod), 240 }, + { SCMP_SYS(shmget), 240 }, + { SCMP_SYS(shmat), 240 }, + { SCMP_SYS(shmdt), 240 } };int seccomp_start (void )
Quoted 5 lines · Paul Moore
It turns out we need to add some additional syscalls to QEMU to make PulseAudio happy. Two minor patches follow ...
---
Quoted 9 lines
Paul Moore (2):
seccomp: addmkdir()andfchmod()to the whitelist
seccomp: add some basic shared memory syscalls to the whitelistqemu-seccomp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)
Paul, sorry for the so late review. I was on vacation until yesterday and I'm still trying to empty my inbox.
Signature · 2 lines
Eduardo Otubo IBM Linux Technology Center
Re: [Qemu-devel] [PATCH 1/2] seccomp: add mkdir() and fchmod() to the whitelist
In reply to Paul MooreI have tested and reviewed both patches. And if nothing more comes up, I'll send a pull request by tomorrow EOD.
Quoted 23 lines · Paul Moore
The PulseAudio library attempts to do a mkdir(2) and fchmod(2) on "/run/user/<UID>/pulse" which is currently blocked by the syscall filter; this patch adds the two missing syscalls to the whitelist. You can reproduce this problem with the following command:
# qemu -monitor stdio -device intel-hda -device hda-duplexIf watched under strace the following syscalls are shown:
mkdir("/run/user/0/pulse", 0700)
fchmod(11, 0700)[NOTE: 11 is the fd for/run/user/0/pulse]Reported-by [email protected]Signed-off-by Paul Moore <[email protected]>--- qemu-seccomp.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-)qemu-seccomp.c +0
-0
qemu-seccomp.c static const struct QemuSeccompSyscall seccomp_whitelist[] = { · line 225
Quoted 7 lines
qemu-seccomp.c +3
-1@@ -220,7 +220,9 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(io_cancel), 241 }, { SCMP_SYS(io_setup), 241 }, { SCMP_SYS(io_destroy), 241 }, - { SCMP_SYS(arch_prctl), 240 } + { SCMP_SYS(arch_prctl), 240 }, + { SCMP_SYS(mkdir), 240 }, + { SCMP_SYS(fchmod), 240 }
ACK.
Signature · 2 lines
Eduardo Otubo IBM Linux Technology Center
Re: [Qemu-devel] [PATCH 2/2] seccomp: add some basic shared memory syscalls to the whitelist
In reply to Paul MooreQuoted 14 lines · Paul Moore
PulseAudio requires the use of shared memory so add
shmget(),shmat(), andshmdt()to the syscall whitelist.Reported-by [email protected]Signed-off-by Paul Moore <[email protected]>--- qemu-seccomp.c | 5 ++++- 1 file changed, 4 insertions(+), 1 deletion(-)qemu-seccomp.c +0
-0
qemu-seccomp.c static const struct QemuSeccompSyscall seccomp_whitelist[] = { · line 228
Quoted 8 lines
qemu-seccomp.c +4
-1@@ -222,7 +222,10 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = { { SCMP_SYS(io_destroy), 241 }, { SCMP_SYS(arch_prctl), 240 }, { SCMP_SYS(mkdir), 240 }, - { SCMP_SYS(fchmod), 240 } + { SCMP_SYS(fchmod), 240 }, + { SCMP_SYS(shmget), 240 }, + { SCMP_SYS(shmat), 240 }, + { SCMP_SYS(shmdt), 240 }
ACK.
Signature · 2 lines
Eduardo Otubo IBM Linux Technology Center
Quoted 10 lines · Eduardo Otubo
Quoted 9 lines · Paul Moore
It turns out we need to add some additional syscalls to QEMU to make PulseAudio happy. Two minor patches follow ...
---
Paul Moore (2):
seccomp: addmkdir()andfchmod()to the whitelist
seccomp: add some basic shared memory syscalls to the whitelist
Quoted 5 lines
Quoted 2 lines
qemu-seccomp.c | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-)Paul, sorry for the so late review. I was on vacation until yesterday and I'm still trying to empty my inbox.
No worries. Personally, I wouldn't call a one day turnaround as a late review, I'd call that pretty good :)
Signature · 2 lines
paul moore security and virtualization @ redhat