Blame SOURCES/kvm-seccomp-set-the-seccomp-filter-to-all-threads.patch

26ba25
From 8bf0cdd586d9868e3432e3d7949c8d628f7e6538 Mon Sep 17 00:00:00 2001
26ba25
From: Eduardo Otubo <otubo@redhat.com>
26ba25
Date: Fri, 28 Sep 2018 07:56:39 +0100
26ba25
Subject: [PATCH 5/6] seccomp: set the seccomp filter to all threads
26ba25
MIME-Version: 1.0
26ba25
Content-Type: text/plain; charset=UTF-8
26ba25
Content-Transfer-Encoding: 8bit
26ba25
26ba25
RH-Author: Eduardo Otubo <otubo@redhat.com>
26ba25
Message-id: <20180928075639.16746-6-otubo@redhat.com>
26ba25
Patchwork-id: 82316
26ba25
O-Subject: [RHEL-8 qemu-kvm PATCH 5/5] seccomp: set the seccomp filter to all threads
26ba25
Bugzilla: 1618356
26ba25
RH-Acked-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
26ba25
RH-Acked-by: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
RH-Acked-by: Thomas Huth <thuth@redhat.com>
26ba25
26ba25
From: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
26ba25
commit 70dfabeaa79ba4d7a3b699abe1a047c8012db114
26ba25
Author: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
Date:   Wed Aug 22 19:02:50 2018 +0200
26ba25
26ba25
    seccomp: set the seccomp filter to all threads
26ba25
26ba25
    When using "-seccomp on", the seccomp policy is only applied to the
26ba25
    main thread, the vcpu worker thread and other worker threads created
26ba25
    after seccomp policy is applied; the seccomp policy is not applied to
26ba25
    e.g. the RCU thread because it is created before the seccomp policy is
26ba25
    applied and SECCOMP_FILTER_FLAG_TSYNC isn't used.
26ba25
26ba25
    This can be verified with
26ba25
    for task in /proc/`pidof qemu`/task/*; do cat $task/status | grep Secc ; done
26ba25
    Seccomp:        2
26ba25
    Seccomp:        0
26ba25
    Seccomp:        0
26ba25
    Seccomp:        2
26ba25
    Seccomp:        2
26ba25
    Seccomp:        2
26ba25
26ba25
    Starting with libseccomp 2.2.0 and kernel >= 3.17, we can use
26ba25
    seccomp_attr_set(ctx, > SCMP_FLTATR_CTL_TSYNC, 1) to update the policy
26ba25
    on all threads.
26ba25
26ba25
    libseccomp requirement was bumped to 2.2.0 in previous patch.
26ba25
    libseccomp should fail to set the filter if it can't honour
26ba25
    SCMP_FLTATR_CTL_TSYNC (untested), and thus -sandbox will now fail on
26ba25
    kernel < 3.17.
26ba25
26ba25
    Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
26ba25
    Acked-by: Eduardo Otubo <otubo@redhat.com>
26ba25
26ba25
Signed-off-by: Eduardo Otubo <otubo@redhat.com>
26ba25
Signed-off-by: Danilo C. L. de Paula <ddepaula@redhat.com>
26ba25
---
26ba25
 qemu-seccomp.c | 5 +++++
26ba25
 1 file changed, 5 insertions(+)
26ba25
26ba25
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
26ba25
index 10fcfa3..a29e54b 100644
26ba25
--- a/qemu-seccomp.c
26ba25
+++ b/qemu-seccomp.c
26ba25
@@ -144,6 +144,11 @@ int seccomp_start(uint32_t seccomp_opts)
26ba25
         goto seccomp_return;
26ba25
     }
26ba25
 
26ba25
+    rc = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_TSYNC, 1);
26ba25
+    if (rc != 0) {
26ba25
+        goto seccomp_return;
26ba25
+    }
26ba25
+
26ba25
     for (i = 0; i < ARRAY_SIZE(blacklist); i++) {
26ba25
         if (!(seccomp_opts & blacklist[i].set)) {
26ba25
             continue;
26ba25
-- 
26ba25
1.8.3.1
26ba25