2 * Seccomp sandboxing for virtiofsd
4 * Copyright (C) 2019 Red Hat, Inc.
6 * SPDX-License-Identifier: GPL-2.0-or-later
9 #include "qemu/osdep.h"
18 /* Bodge for libseccomp 2.4.2 which broke ppoll */
19 #if !defined(__SNR_ppoll) && defined(__SNR_brk)
21 #define __SNR_ppoll __NR_ppoll
23 #define __SNR_ppoll __PNR_ppoll
27 static const int syscall_whitelist
[] = {
28 /* TODO ireg sem*() syscalls */
30 SCMP_SYS(capget
), /* For CAP_FSETID */
32 SCMP_SYS(clock_gettime
),
38 SCMP_SYS(copy_file_range
),
51 SCMP_SYS(fremovexattr
),
64 SCMP_SYS(gettimeofday
),
78 SCMP_SYS(prctl
), /* TODO restrict to just PR_SET_NAME? */
88 SCMP_SYS(rt_sigaction
),
89 SCMP_SYS(rt_sigprocmask
),
90 SCMP_SYS(rt_sigreturn
),
94 #ifdef __NR_setresgid32
95 SCMP_SYS(setresgid32
),
97 #ifdef __NR_setresuid32
98 SCMP_SYS(setresuid32
),
100 SCMP_SYS(set_robust_list
),
102 SCMP_SYS(time
), /* Rarely needed, except on static builds */
110 /* Syscalls used when --syslog is enabled */
111 static const int syscall_whitelist_syslog
[] = {
115 static void add_whitelist(scmp_filter_ctx ctx
, const int syscalls
[], size_t len
)
119 for (i
= 0; i
< len
; i
++) {
120 if (seccomp_rule_add(ctx
, SCMP_ACT_ALLOW
, syscalls
[i
], 0) != 0) {
121 fuse_log(FUSE_LOG_ERR
, "seccomp_rule_add syscall %d failed\n",
128 void setup_seccomp(bool enable_syslog
)
132 #ifdef SCMP_ACT_KILL_PROCESS
133 ctx
= seccomp_init(SCMP_ACT_KILL_PROCESS
);
134 /* Handle a newer libseccomp but an older kernel */
135 if (!ctx
&& errno
== EOPNOTSUPP
) {
136 ctx
= seccomp_init(SCMP_ACT_TRAP
);
139 ctx
= seccomp_init(SCMP_ACT_TRAP
);
142 fuse_log(FUSE_LOG_ERR
, "seccomp_init() failed\n");
146 add_whitelist(ctx
, syscall_whitelist
, G_N_ELEMENTS(syscall_whitelist
));
148 add_whitelist(ctx
, syscall_whitelist_syslog
,
149 G_N_ELEMENTS(syscall_whitelist_syslog
));
152 /* libvhost-user calls this for post-copy migration, we don't need it */
153 if (seccomp_rule_add(ctx
, SCMP_ACT_ERRNO(ENOSYS
),
154 SCMP_SYS(userfaultfd
), 0) != 0) {
155 fuse_log(FUSE_LOG_ERR
, "seccomp_rule_add userfaultfd failed\n");
159 if (seccomp_load(ctx
) < 0) {
160 fuse_log(FUSE_LOG_ERR
, "seccomp_load() failed\n");
164 seccomp_release(ctx
);