]>
Commit | Line | Data |
---|---|---|
2f668be7 EO |
1 | /* |
2 | * QEMU seccomp mode 2 support with libseccomp | |
3 | * | |
4 | * Copyright IBM, Corp. 2012 | |
5 | * | |
6 | * Authors: | |
7 | * Eduardo Otubo <eotubo@br.ibm.com> | |
8 | * | |
9 | * This work is licensed under the terms of the GNU GPL, version 2. See | |
10 | * the COPYING file in the top-level directory. | |
11 | * | |
12 | * Contributions after 2012-01-13 are licensed under the terms of the | |
13 | * GNU GPL, version 2 or (at your option) any later version. | |
14 | */ | |
65484597 | 15 | |
d38ea87a | 16 | #include "qemu/osdep.h" |
65484597 | 17 | #include "qapi/error.h" |
9d0fdecb YMZ |
18 | #include "qemu/config-file.h" |
19 | #include "qemu/option.h" | |
20 | #include "qemu/module.h" | |
9d0fdecb | 21 | #include <sys/prctl.h> |
2f668be7 | 22 | #include <seccomp.h> |
9c17d615 | 23 | #include "sysemu/seccomp.h" |
bda08a57 | 24 | #include <linux/seccomp.h> |
2f668be7 | 25 | |
81bed73b JH |
26 | /* For some architectures (notably ARM) cacheflush is not supported until |
27 | * libseccomp 2.2.3, but configure enforces that we are using a more recent | |
28 | * version on those hosts, so it is OK for this check to be less strict. | |
29 | */ | |
47d2067a AJ |
30 | #if SCMP_VER_MAJOR >= 3 |
31 | #define HAVE_CACHEFLUSH | |
81bed73b | 32 | #elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 2 |
47d2067a AJ |
33 | #define HAVE_CACHEFLUSH |
34 | #endif | |
35 | ||
2f668be7 EO |
36 | struct QemuSeccompSyscall { |
37 | int32_t num; | |
1bd6152a | 38 | uint8_t set; |
056de1e8 MAL |
39 | uint8_t narg; |
40 | const struct scmp_arg_cmp *arg_cmp; | |
41 | }; | |
42 | ||
43 | const struct scmp_arg_cmp sched_setscheduler_arg[] = { | |
e81e7b52 TH |
44 | /* was SCMP_A1(SCMP_CMP_NE, SCHED_IDLE), but expanded due to GCC 4.x bug */ |
45 | { .arg = 1, .op = SCMP_CMP_NE, .datum_a = SCHED_IDLE } | |
2f668be7 EO |
46 | }; |
47 | ||
1bd6152a EO |
48 | static const struct QemuSeccompSyscall blacklist[] = { |
49 | /* default set of syscalls to blacklist */ | |
50 | { SCMP_SYS(reboot), QEMU_SECCOMP_SET_DEFAULT }, | |
51 | { SCMP_SYS(swapon), QEMU_SECCOMP_SET_DEFAULT }, | |
52 | { SCMP_SYS(swapoff), QEMU_SECCOMP_SET_DEFAULT }, | |
53 | { SCMP_SYS(syslog), QEMU_SECCOMP_SET_DEFAULT }, | |
54 | { SCMP_SYS(mount), QEMU_SECCOMP_SET_DEFAULT }, | |
55 | { SCMP_SYS(umount), QEMU_SECCOMP_SET_DEFAULT }, | |
56 | { SCMP_SYS(kexec_load), QEMU_SECCOMP_SET_DEFAULT }, | |
57 | { SCMP_SYS(afs_syscall), QEMU_SECCOMP_SET_DEFAULT }, | |
58 | { SCMP_SYS(break), QEMU_SECCOMP_SET_DEFAULT }, | |
59 | { SCMP_SYS(ftime), QEMU_SECCOMP_SET_DEFAULT }, | |
60 | { SCMP_SYS(getpmsg), QEMU_SECCOMP_SET_DEFAULT }, | |
61 | { SCMP_SYS(gtty), QEMU_SECCOMP_SET_DEFAULT }, | |
62 | { SCMP_SYS(lock), QEMU_SECCOMP_SET_DEFAULT }, | |
63 | { SCMP_SYS(mpx), QEMU_SECCOMP_SET_DEFAULT }, | |
64 | { SCMP_SYS(prof), QEMU_SECCOMP_SET_DEFAULT }, | |
65 | { SCMP_SYS(profil), QEMU_SECCOMP_SET_DEFAULT }, | |
66 | { SCMP_SYS(putpmsg), QEMU_SECCOMP_SET_DEFAULT }, | |
67 | { SCMP_SYS(security), QEMU_SECCOMP_SET_DEFAULT }, | |
68 | { SCMP_SYS(stty), QEMU_SECCOMP_SET_DEFAULT }, | |
69 | { SCMP_SYS(tuxcall), QEMU_SECCOMP_SET_DEFAULT }, | |
70 | { SCMP_SYS(ulimit), QEMU_SECCOMP_SET_DEFAULT }, | |
71 | { SCMP_SYS(vserver), QEMU_SECCOMP_SET_DEFAULT }, | |
2b716fa6 EO |
72 | /* obsolete */ |
73 | { SCMP_SYS(readdir), QEMU_SECCOMP_SET_OBSOLETE }, | |
74 | { SCMP_SYS(_sysctl), QEMU_SECCOMP_SET_OBSOLETE }, | |
75 | { SCMP_SYS(bdflush), QEMU_SECCOMP_SET_OBSOLETE }, | |
76 | { SCMP_SYS(create_module), QEMU_SECCOMP_SET_OBSOLETE }, | |
77 | { SCMP_SYS(get_kernel_syms), QEMU_SECCOMP_SET_OBSOLETE }, | |
78 | { SCMP_SYS(query_module), QEMU_SECCOMP_SET_OBSOLETE }, | |
79 | { SCMP_SYS(sgetmask), QEMU_SECCOMP_SET_OBSOLETE }, | |
80 | { SCMP_SYS(ssetmask), QEMU_SECCOMP_SET_OBSOLETE }, | |
81 | { SCMP_SYS(sysfs), QEMU_SECCOMP_SET_OBSOLETE }, | |
82 | { SCMP_SYS(uselib), QEMU_SECCOMP_SET_OBSOLETE }, | |
83 | { SCMP_SYS(ustat), QEMU_SECCOMP_SET_OBSOLETE }, | |
73a1e647 EO |
84 | /* privileged */ |
85 | { SCMP_SYS(setuid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
86 | { SCMP_SYS(setgid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
87 | { SCMP_SYS(setpgid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
88 | { SCMP_SYS(setsid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
89 | { SCMP_SYS(setreuid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
90 | { SCMP_SYS(setregid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
91 | { SCMP_SYS(setresuid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
92 | { SCMP_SYS(setresgid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
93 | { SCMP_SYS(setfsuid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
94 | { SCMP_SYS(setfsgid), QEMU_SECCOMP_SET_PRIVILEGED }, | |
995a226f EO |
95 | /* spawn */ |
96 | { SCMP_SYS(fork), QEMU_SECCOMP_SET_SPAWN }, | |
97 | { SCMP_SYS(vfork), QEMU_SECCOMP_SET_SPAWN }, | |
98 | { SCMP_SYS(execve), QEMU_SECCOMP_SET_SPAWN }, | |
24f8cdc5 EO |
99 | /* resource control */ |
100 | { SCMP_SYS(getpriority), QEMU_SECCOMP_SET_RESOURCECTL }, | |
101 | { SCMP_SYS(setpriority), QEMU_SECCOMP_SET_RESOURCECTL }, | |
102 | { SCMP_SYS(sched_setparam), QEMU_SECCOMP_SET_RESOURCECTL }, | |
103 | { SCMP_SYS(sched_getparam), QEMU_SECCOMP_SET_RESOURCECTL }, | |
056de1e8 MAL |
104 | { SCMP_SYS(sched_setscheduler), QEMU_SECCOMP_SET_RESOURCECTL, |
105 | ARRAY_SIZE(sched_setscheduler_arg), sched_setscheduler_arg }, | |
24f8cdc5 EO |
106 | { SCMP_SYS(sched_getscheduler), QEMU_SECCOMP_SET_RESOURCECTL }, |
107 | { SCMP_SYS(sched_setaffinity), QEMU_SECCOMP_SET_RESOURCECTL }, | |
108 | { SCMP_SYS(sched_getaffinity), QEMU_SECCOMP_SET_RESOURCECTL }, | |
109 | { SCMP_SYS(sched_get_priority_max), QEMU_SECCOMP_SET_RESOURCECTL }, | |
110 | { SCMP_SYS(sched_get_priority_min), QEMU_SECCOMP_SET_RESOURCECTL }, | |
2f668be7 EO |
111 | }; |
112 | ||
bda08a57 MAL |
113 | static inline __attribute__((unused)) int |
114 | qemu_seccomp(unsigned int operation, unsigned int flags, void *args) | |
115 | { | |
116 | #ifdef __NR_seccomp | |
117 | return syscall(__NR_seccomp, operation, flags, args); | |
118 | #else | |
119 | errno = ENOSYS; | |
120 | return -1; | |
121 | #endif | |
122 | } | |
123 | ||
9a1565a0 | 124 | static uint32_t qemu_seccomp_get_action(int set) |
bda08a57 | 125 | { |
9a1565a0 DB |
126 | switch (set) { |
127 | case QEMU_SECCOMP_SET_DEFAULT: | |
128 | case QEMU_SECCOMP_SET_OBSOLETE: | |
129 | case QEMU_SECCOMP_SET_PRIVILEGED: | |
130 | case QEMU_SECCOMP_SET_SPAWN: { | |
bda08a57 MAL |
131 | #if defined(SECCOMP_GET_ACTION_AVAIL) && defined(SCMP_ACT_KILL_PROCESS) && \ |
132 | defined(SECCOMP_RET_KILL_PROCESS) | |
9a1565a0 DB |
133 | static int kill_process = -1; |
134 | if (kill_process == -1) { | |
135 | uint32_t action = SECCOMP_RET_KILL_PROCESS; | |
bda08a57 | 136 | |
9a1565a0 DB |
137 | if (qemu_seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &action) == 0) { |
138 | kill_process = 1; | |
e474e3aa DB |
139 | } else { |
140 | kill_process = 0; | |
9a1565a0 | 141 | } |
9a1565a0 DB |
142 | } |
143 | if (kill_process == 1) { | |
bda08a57 MAL |
144 | return SCMP_ACT_KILL_PROCESS; |
145 | } | |
bda08a57 | 146 | #endif |
9a1565a0 DB |
147 | return SCMP_ACT_TRAP; |
148 | } | |
bda08a57 | 149 | |
9a1565a0 DB |
150 | case QEMU_SECCOMP_SET_RESOURCECTL: |
151 | return SCMP_ACT_ERRNO(EPERM); | |
152 | ||
153 | default: | |
154 | g_assert_not_reached(); | |
155 | } | |
bda08a57 MAL |
156 | } |
157 | ||
2b716fa6 | 158 | |
035121d2 | 159 | static int seccomp_start(uint32_t seccomp_opts, Error **errp) |
2f668be7 | 160 | { |
035121d2 | 161 | int rc = -1; |
2f668be7 EO |
162 | unsigned int i = 0; |
163 | scmp_filter_ctx ctx; | |
164 | ||
1bd6152a | 165 | ctx = seccomp_init(SCMP_ACT_ALLOW); |
2f668be7 | 166 | if (ctx == NULL) { |
035121d2 | 167 | error_setg(errp, "failed to initialize seccomp context"); |
2f668be7 EO |
168 | goto seccomp_return; |
169 | } | |
170 | ||
70dfabea MAL |
171 | rc = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_TSYNC, 1); |
172 | if (rc != 0) { | |
035121d2 DB |
173 | error_setg_errno(errp, -rc, |
174 | "failed to set seccomp thread synchronization"); | |
70dfabea MAL |
175 | goto seccomp_return; |
176 | } | |
177 | ||
1bd6152a | 178 | for (i = 0; i < ARRAY_SIZE(blacklist); i++) { |
9a1565a0 | 179 | uint32_t action; |
2b716fa6 EO |
180 | if (!(seccomp_opts & blacklist[i].set)) { |
181 | continue; | |
182 | } | |
183 | ||
9a1565a0 | 184 | action = qemu_seccomp_get_action(blacklist[i].set); |
bda08a57 | 185 | rc = seccomp_rule_add_array(ctx, action, blacklist[i].num, |
056de1e8 | 186 | blacklist[i].narg, blacklist[i].arg_cmp); |
2f668be7 | 187 | if (rc < 0) { |
035121d2 DB |
188 | error_setg_errno(errp, -rc, |
189 | "failed to add seccomp blacklist rules"); | |
2f668be7 EO |
190 | goto seccomp_return; |
191 | } | |
192 | } | |
193 | ||
194 | rc = seccomp_load(ctx); | |
035121d2 DB |
195 | if (rc < 0) { |
196 | error_setg_errno(errp, -rc, | |
197 | "failed to load seccomp syscall filter in kernel"); | |
198 | } | |
2f668be7 EO |
199 | |
200 | seccomp_return: | |
201 | seccomp_release(ctx); | |
035121d2 | 202 | return rc < 0 ? -1 : 0; |
2f668be7 | 203 | } |
9d0fdecb YMZ |
204 | |
205 | #ifdef CONFIG_SECCOMP | |
206 | int parse_sandbox(void *opaque, QemuOpts *opts, Error **errp) | |
207 | { | |
208 | if (qemu_opt_get_bool(opts, "enable", false)) { | |
209 | uint32_t seccomp_opts = QEMU_SECCOMP_SET_DEFAULT | |
210 | | QEMU_SECCOMP_SET_OBSOLETE; | |
211 | const char *value = NULL; | |
212 | ||
213 | value = qemu_opt_get(opts, "obsolete"); | |
214 | if (value) { | |
215 | if (g_str_equal(value, "allow")) { | |
216 | seccomp_opts &= ~QEMU_SECCOMP_SET_OBSOLETE; | |
217 | } else if (g_str_equal(value, "deny")) { | |
218 | /* this is the default option, this if is here | |
219 | * to provide a little bit of consistency for | |
220 | * the command line */ | |
221 | } else { | |
65484597 | 222 | error_setg(errp, "invalid argument for obsolete"); |
9d0fdecb YMZ |
223 | return -1; |
224 | } | |
225 | } | |
226 | ||
227 | value = qemu_opt_get(opts, "elevateprivileges"); | |
228 | if (value) { | |
229 | if (g_str_equal(value, "deny")) { | |
230 | seccomp_opts |= QEMU_SECCOMP_SET_PRIVILEGED; | |
231 | } else if (g_str_equal(value, "children")) { | |
232 | seccomp_opts |= QEMU_SECCOMP_SET_PRIVILEGED; | |
233 | ||
234 | /* calling prctl directly because we're | |
235 | * not sure if host has CAP_SYS_ADMIN set*/ | |
236 | if (prctl(PR_SET_NO_NEW_PRIVS, 1)) { | |
65484597 | 237 | error_setg(errp, "failed to set no_new_privs aborting"); |
9d0fdecb YMZ |
238 | return -1; |
239 | } | |
240 | } else if (g_str_equal(value, "allow")) { | |
241 | /* default value */ | |
242 | } else { | |
65484597 | 243 | error_setg(errp, "invalid argument for elevateprivileges"); |
9d0fdecb YMZ |
244 | return -1; |
245 | } | |
246 | } | |
247 | ||
248 | value = qemu_opt_get(opts, "spawn"); | |
249 | if (value) { | |
250 | if (g_str_equal(value, "deny")) { | |
251 | seccomp_opts |= QEMU_SECCOMP_SET_SPAWN; | |
252 | } else if (g_str_equal(value, "allow")) { | |
253 | /* default value */ | |
254 | } else { | |
65484597 | 255 | error_setg(errp, "invalid argument for spawn"); |
9d0fdecb YMZ |
256 | return -1; |
257 | } | |
258 | } | |
259 | ||
260 | value = qemu_opt_get(opts, "resourcecontrol"); | |
261 | if (value) { | |
262 | if (g_str_equal(value, "deny")) { | |
263 | seccomp_opts |= QEMU_SECCOMP_SET_RESOURCECTL; | |
264 | } else if (g_str_equal(value, "allow")) { | |
265 | /* default value */ | |
266 | } else { | |
65484597 | 267 | error_setg(errp, "invalid argument for resourcecontrol"); |
9d0fdecb YMZ |
268 | return -1; |
269 | } | |
270 | } | |
271 | ||
035121d2 | 272 | if (seccomp_start(seccomp_opts, errp) < 0) { |
9d0fdecb YMZ |
273 | return -1; |
274 | } | |
275 | } | |
276 | ||
277 | return 0; | |
278 | } | |
279 | ||
280 | static QemuOptsList qemu_sandbox_opts = { | |
281 | .name = "sandbox", | |
282 | .implied_opt_name = "enable", | |
283 | .head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head), | |
284 | .desc = { | |
285 | { | |
286 | .name = "enable", | |
287 | .type = QEMU_OPT_BOOL, | |
288 | }, | |
289 | { | |
290 | .name = "obsolete", | |
291 | .type = QEMU_OPT_STRING, | |
292 | }, | |
293 | { | |
294 | .name = "elevateprivileges", | |
295 | .type = QEMU_OPT_STRING, | |
296 | }, | |
297 | { | |
298 | .name = "spawn", | |
299 | .type = QEMU_OPT_STRING, | |
300 | }, | |
301 | { | |
302 | .name = "resourcecontrol", | |
303 | .type = QEMU_OPT_STRING, | |
304 | }, | |
305 | { /* end of list */ } | |
306 | }, | |
307 | }; | |
308 | ||
309 | static void seccomp_register(void) | |
310 | { | |
5780760f MAL |
311 | bool add = false; |
312 | ||
313 | /* FIXME: use seccomp_api_get() >= 2 check when released */ | |
314 | ||
315 | #if defined(SECCOMP_FILTER_FLAG_TSYNC) | |
316 | int check; | |
317 | ||
318 | /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */ | |
319 | check = qemu_seccomp(SECCOMP_SET_MODE_FILTER, | |
320 | SECCOMP_FILTER_FLAG_TSYNC, NULL); | |
321 | if (check < 0 && errno == EFAULT) { | |
322 | add = true; | |
323 | } | |
324 | #endif | |
325 | ||
326 | if (add) { | |
327 | qemu_add_opts(&qemu_sandbox_opts); | |
328 | } | |
9d0fdecb YMZ |
329 | } |
330 | opts_init(seccomp_register); | |
331 | #endif |