2 * QEMU seccomp mode 2 support with libseccomp
4 * Copyright IBM, Corp. 2012
7 * Eduardo Otubo <eotubo@br.ibm.com>
9 * This work is licensed under the terms of the GNU GPL, version 2. See
10 * the COPYING file in the top-level directory.
12 * Contributions after 2012-01-13 are licensed under the terms of the
13 * GNU GPL, version 2 or (at your option) any later version.
15 #include "qemu/osdep.h"
16 #include "qemu/config-file.h"
17 #include "qemu/option.h"
18 #include "qemu/module.h"
19 #include "qemu/error-report.h"
20 #include <sys/prctl.h>
22 #include "sysemu/seccomp.h"
24 /* For some architectures (notably ARM) cacheflush is not supported until
25 * libseccomp 2.2.3, but configure enforces that we are using a more recent
26 * version on those hosts, so it is OK for this check to be less strict.
28 #if SCMP_VER_MAJOR >= 3
29 #define HAVE_CACHEFLUSH
30 #elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 2
31 #define HAVE_CACHEFLUSH
34 struct QemuSeccompSyscall
{
38 const struct scmp_arg_cmp
*arg_cmp
;
41 const struct scmp_arg_cmp sched_setscheduler_arg
[] = {
42 SCMP_A1(SCMP_CMP_NE
, SCHED_IDLE
)
45 static const struct QemuSeccompSyscall blacklist
[] = {
46 /* default set of syscalls to blacklist */
47 { SCMP_SYS(reboot
), QEMU_SECCOMP_SET_DEFAULT
},
48 { SCMP_SYS(swapon
), QEMU_SECCOMP_SET_DEFAULT
},
49 { SCMP_SYS(swapoff
), QEMU_SECCOMP_SET_DEFAULT
},
50 { SCMP_SYS(syslog
), QEMU_SECCOMP_SET_DEFAULT
},
51 { SCMP_SYS(mount
), QEMU_SECCOMP_SET_DEFAULT
},
52 { SCMP_SYS(umount
), QEMU_SECCOMP_SET_DEFAULT
},
53 { SCMP_SYS(kexec_load
), QEMU_SECCOMP_SET_DEFAULT
},
54 { SCMP_SYS(afs_syscall
), QEMU_SECCOMP_SET_DEFAULT
},
55 { SCMP_SYS(break), QEMU_SECCOMP_SET_DEFAULT
},
56 { SCMP_SYS(ftime
), QEMU_SECCOMP_SET_DEFAULT
},
57 { SCMP_SYS(getpmsg
), QEMU_SECCOMP_SET_DEFAULT
},
58 { SCMP_SYS(gtty
), QEMU_SECCOMP_SET_DEFAULT
},
59 { SCMP_SYS(lock
), QEMU_SECCOMP_SET_DEFAULT
},
60 { SCMP_SYS(mpx
), QEMU_SECCOMP_SET_DEFAULT
},
61 { SCMP_SYS(prof
), QEMU_SECCOMP_SET_DEFAULT
},
62 { SCMP_SYS(profil
), QEMU_SECCOMP_SET_DEFAULT
},
63 { SCMP_SYS(putpmsg
), QEMU_SECCOMP_SET_DEFAULT
},
64 { SCMP_SYS(security
), QEMU_SECCOMP_SET_DEFAULT
},
65 { SCMP_SYS(stty
), QEMU_SECCOMP_SET_DEFAULT
},
66 { SCMP_SYS(tuxcall
), QEMU_SECCOMP_SET_DEFAULT
},
67 { SCMP_SYS(ulimit
), QEMU_SECCOMP_SET_DEFAULT
},
68 { SCMP_SYS(vserver
), QEMU_SECCOMP_SET_DEFAULT
},
70 { SCMP_SYS(readdir
), QEMU_SECCOMP_SET_OBSOLETE
},
71 { SCMP_SYS(_sysctl
), QEMU_SECCOMP_SET_OBSOLETE
},
72 { SCMP_SYS(bdflush
), QEMU_SECCOMP_SET_OBSOLETE
},
73 { SCMP_SYS(create_module
), QEMU_SECCOMP_SET_OBSOLETE
},
74 { SCMP_SYS(get_kernel_syms
), QEMU_SECCOMP_SET_OBSOLETE
},
75 { SCMP_SYS(query_module
), QEMU_SECCOMP_SET_OBSOLETE
},
76 { SCMP_SYS(sgetmask
), QEMU_SECCOMP_SET_OBSOLETE
},
77 { SCMP_SYS(ssetmask
), QEMU_SECCOMP_SET_OBSOLETE
},
78 { SCMP_SYS(sysfs
), QEMU_SECCOMP_SET_OBSOLETE
},
79 { SCMP_SYS(uselib
), QEMU_SECCOMP_SET_OBSOLETE
},
80 { SCMP_SYS(ustat
), QEMU_SECCOMP_SET_OBSOLETE
},
82 { SCMP_SYS(setuid
), QEMU_SECCOMP_SET_PRIVILEGED
},
83 { SCMP_SYS(setgid
), QEMU_SECCOMP_SET_PRIVILEGED
},
84 { SCMP_SYS(setpgid
), QEMU_SECCOMP_SET_PRIVILEGED
},
85 { SCMP_SYS(setsid
), QEMU_SECCOMP_SET_PRIVILEGED
},
86 { SCMP_SYS(setreuid
), QEMU_SECCOMP_SET_PRIVILEGED
},
87 { SCMP_SYS(setregid
), QEMU_SECCOMP_SET_PRIVILEGED
},
88 { SCMP_SYS(setresuid
), QEMU_SECCOMP_SET_PRIVILEGED
},
89 { SCMP_SYS(setresgid
), QEMU_SECCOMP_SET_PRIVILEGED
},
90 { SCMP_SYS(setfsuid
), QEMU_SECCOMP_SET_PRIVILEGED
},
91 { SCMP_SYS(setfsgid
), QEMU_SECCOMP_SET_PRIVILEGED
},
93 { SCMP_SYS(fork
), QEMU_SECCOMP_SET_SPAWN
},
94 { SCMP_SYS(vfork
), QEMU_SECCOMP_SET_SPAWN
},
95 { SCMP_SYS(execve
), QEMU_SECCOMP_SET_SPAWN
},
96 /* resource control */
97 { SCMP_SYS(getpriority
), QEMU_SECCOMP_SET_RESOURCECTL
},
98 { SCMP_SYS(setpriority
), QEMU_SECCOMP_SET_RESOURCECTL
},
99 { SCMP_SYS(sched_setparam
), QEMU_SECCOMP_SET_RESOURCECTL
},
100 { SCMP_SYS(sched_getparam
), QEMU_SECCOMP_SET_RESOURCECTL
},
101 { SCMP_SYS(sched_setscheduler
), QEMU_SECCOMP_SET_RESOURCECTL
,
102 ARRAY_SIZE(sched_setscheduler_arg
), sched_setscheduler_arg
},
103 { SCMP_SYS(sched_getscheduler
), QEMU_SECCOMP_SET_RESOURCECTL
},
104 { SCMP_SYS(sched_setaffinity
), QEMU_SECCOMP_SET_RESOURCECTL
},
105 { SCMP_SYS(sched_getaffinity
), QEMU_SECCOMP_SET_RESOURCECTL
},
106 { SCMP_SYS(sched_get_priority_max
), QEMU_SECCOMP_SET_RESOURCECTL
},
107 { SCMP_SYS(sched_get_priority_min
), QEMU_SECCOMP_SET_RESOURCECTL
},
111 static int seccomp_start(uint32_t seccomp_opts
)
117 ctx
= seccomp_init(SCMP_ACT_ALLOW
);
123 for (i
= 0; i
< ARRAY_SIZE(blacklist
); i
++) {
124 if (!(seccomp_opts
& blacklist
[i
].set
)) {
128 rc
= seccomp_rule_add_array(ctx
, SCMP_ACT_KILL
, blacklist
[i
].num
,
129 blacklist
[i
].narg
, blacklist
[i
].arg_cmp
);
135 rc
= seccomp_load(ctx
);
138 seccomp_release(ctx
);
142 #ifdef CONFIG_SECCOMP
143 int parse_sandbox(void *opaque
, QemuOpts
*opts
, Error
**errp
)
145 if (qemu_opt_get_bool(opts
, "enable", false)) {
146 uint32_t seccomp_opts
= QEMU_SECCOMP_SET_DEFAULT
147 | QEMU_SECCOMP_SET_OBSOLETE
;
148 const char *value
= NULL
;
150 value
= qemu_opt_get(opts
, "obsolete");
152 if (g_str_equal(value
, "allow")) {
153 seccomp_opts
&= ~QEMU_SECCOMP_SET_OBSOLETE
;
154 } else if (g_str_equal(value
, "deny")) {
155 /* this is the default option, this if is here
156 * to provide a little bit of consistency for
157 * the command line */
159 error_report("invalid argument for obsolete");
164 value
= qemu_opt_get(opts
, "elevateprivileges");
166 if (g_str_equal(value
, "deny")) {
167 seccomp_opts
|= QEMU_SECCOMP_SET_PRIVILEGED
;
168 } else if (g_str_equal(value
, "children")) {
169 seccomp_opts
|= QEMU_SECCOMP_SET_PRIVILEGED
;
171 /* calling prctl directly because we're
172 * not sure if host has CAP_SYS_ADMIN set*/
173 if (prctl(PR_SET_NO_NEW_PRIVS
, 1)) {
174 error_report("failed to set no_new_privs "
178 } else if (g_str_equal(value
, "allow")) {
181 error_report("invalid argument for elevateprivileges");
186 value
= qemu_opt_get(opts
, "spawn");
188 if (g_str_equal(value
, "deny")) {
189 seccomp_opts
|= QEMU_SECCOMP_SET_SPAWN
;
190 } else if (g_str_equal(value
, "allow")) {
193 error_report("invalid argument for spawn");
198 value
= qemu_opt_get(opts
, "resourcecontrol");
200 if (g_str_equal(value
, "deny")) {
201 seccomp_opts
|= QEMU_SECCOMP_SET_RESOURCECTL
;
202 } else if (g_str_equal(value
, "allow")) {
205 error_report("invalid argument for resourcecontrol");
210 if (seccomp_start(seccomp_opts
) < 0) {
211 error_report("failed to install seccomp syscall filter "
220 static QemuOptsList qemu_sandbox_opts
= {
222 .implied_opt_name
= "enable",
223 .head
= QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts
.head
),
227 .type
= QEMU_OPT_BOOL
,
231 .type
= QEMU_OPT_STRING
,
234 .name
= "elevateprivileges",
235 .type
= QEMU_OPT_STRING
,
239 .type
= QEMU_OPT_STRING
,
242 .name
= "resourcecontrol",
243 .type
= QEMU_OPT_STRING
,
245 { /* end of list */ }
249 static void seccomp_register(void)
251 qemu_add_opts(&qemu_sandbox_opts
);
253 opts_init(seccomp_register
);