18d7f2e76SPhilippe Mathieu-Daudé /*
28d7f2e76SPhilippe Mathieu-Daudé * QEMU seccomp mode 2 support with libseccomp
38d7f2e76SPhilippe Mathieu-Daudé *
48d7f2e76SPhilippe Mathieu-Daudé * Copyright IBM, Corp. 2012
58d7f2e76SPhilippe Mathieu-Daudé *
68d7f2e76SPhilippe Mathieu-Daudé * Authors:
78d7f2e76SPhilippe Mathieu-Daudé * Eduardo Otubo <eotubo@br.ibm.com>
88d7f2e76SPhilippe Mathieu-Daudé *
98d7f2e76SPhilippe Mathieu-Daudé * This work is licensed under the terms of the GNU GPL, version 2. See
108d7f2e76SPhilippe Mathieu-Daudé * the COPYING file in the top-level directory.
118d7f2e76SPhilippe Mathieu-Daudé *
128d7f2e76SPhilippe Mathieu-Daudé * Contributions after 2012-01-13 are licensed under the terms of the
138d7f2e76SPhilippe Mathieu-Daudé * GNU GPL, version 2 or (at your option) any later version.
148d7f2e76SPhilippe Mathieu-Daudé */
158d7f2e76SPhilippe Mathieu-Daudé
168d7f2e76SPhilippe Mathieu-Daudé #include "qemu/osdep.h"
178d7f2e76SPhilippe Mathieu-Daudé #include "qapi/error.h"
188d7f2e76SPhilippe Mathieu-Daudé #include "qemu/config-file.h"
198d7f2e76SPhilippe Mathieu-Daudé #include "qemu/option.h"
208d7f2e76SPhilippe Mathieu-Daudé #include "qemu/module.h"
218d7f2e76SPhilippe Mathieu-Daudé #include <sys/prctl.h>
228d7f2e76SPhilippe Mathieu-Daudé #include <seccomp.h>
238d7f2e76SPhilippe Mathieu-Daudé #include "sysemu/seccomp.h"
248d7f2e76SPhilippe Mathieu-Daudé #include <linux/seccomp.h>
258d7f2e76SPhilippe Mathieu-Daudé
268d7f2e76SPhilippe Mathieu-Daudé /* For some architectures (notably ARM) cacheflush is not supported until
278d7f2e76SPhilippe Mathieu-Daudé * libseccomp 2.2.3, but configure enforces that we are using a more recent
288d7f2e76SPhilippe Mathieu-Daudé * version on those hosts, so it is OK for this check to be less strict.
298d7f2e76SPhilippe Mathieu-Daudé */
308d7f2e76SPhilippe Mathieu-Daudé #if SCMP_VER_MAJOR >= 3
318d7f2e76SPhilippe Mathieu-Daudé #define HAVE_CACHEFLUSH
328d7f2e76SPhilippe Mathieu-Daudé #elif SCMP_VER_MAJOR == 2 && SCMP_VER_MINOR >= 2
338d7f2e76SPhilippe Mathieu-Daudé #define HAVE_CACHEFLUSH
348d7f2e76SPhilippe Mathieu-Daudé #endif
358d7f2e76SPhilippe Mathieu-Daudé
368d7f2e76SPhilippe Mathieu-Daudé struct QemuSeccompSyscall {
378d7f2e76SPhilippe Mathieu-Daudé int32_t num;
388d7f2e76SPhilippe Mathieu-Daudé uint8_t set;
398d7f2e76SPhilippe Mathieu-Daudé uint8_t narg;
408d7f2e76SPhilippe Mathieu-Daudé const struct scmp_arg_cmp *arg_cmp;
418d7f2e76SPhilippe Mathieu-Daudé uint32_t action;
428d7f2e76SPhilippe Mathieu-Daudé };
438d7f2e76SPhilippe Mathieu-Daudé
448d7f2e76SPhilippe Mathieu-Daudé const struct scmp_arg_cmp sched_setscheduler_arg[] = {
458d7f2e76SPhilippe Mathieu-Daudé /* was SCMP_A1(SCMP_CMP_NE, SCHED_IDLE), but expanded due to GCC 4.x bug */
468d7f2e76SPhilippe Mathieu-Daudé { .arg = 1, .op = SCMP_CMP_NE, .datum_a = SCHED_IDLE }
478d7f2e76SPhilippe Mathieu-Daudé };
488d7f2e76SPhilippe Mathieu-Daudé
498d7f2e76SPhilippe Mathieu-Daudé /*
50*990d2c18SPhilippe Mathieu-Daudé * See 'NOTES' in 'man 2 clone' - s390 has 'flags' in
518d7f2e76SPhilippe Mathieu-Daudé * different position to other architectures
528d7f2e76SPhilippe Mathieu-Daudé */
53*990d2c18SPhilippe Mathieu-Daudé #if defined(HOST_S390X) || defined(HOST_S390)
548d7f2e76SPhilippe Mathieu-Daudé #define CLONE_FLAGS_ARG 1
558d7f2e76SPhilippe Mathieu-Daudé #else
568d7f2e76SPhilippe Mathieu-Daudé #define CLONE_FLAGS_ARG 0
578d7f2e76SPhilippe Mathieu-Daudé #endif
588d7f2e76SPhilippe Mathieu-Daudé
598d7f2e76SPhilippe Mathieu-Daudé #ifndef CLONE_PIDFD
608d7f2e76SPhilippe Mathieu-Daudé # define CLONE_PIDFD 0x00001000
618d7f2e76SPhilippe Mathieu-Daudé #endif
628d7f2e76SPhilippe Mathieu-Daudé
638d7f2e76SPhilippe Mathieu-Daudé #define REQUIRE_CLONE_FLAG(flag) \
648d7f2e76SPhilippe Mathieu-Daudé const struct scmp_arg_cmp clone_arg ## flag[] = { \
658d7f2e76SPhilippe Mathieu-Daudé { .arg = CLONE_FLAGS_ARG, \
668d7f2e76SPhilippe Mathieu-Daudé .op = SCMP_CMP_MASKED_EQ, \
678d7f2e76SPhilippe Mathieu-Daudé .datum_a = flag, .datum_b = 0 } }
688d7f2e76SPhilippe Mathieu-Daudé
698d7f2e76SPhilippe Mathieu-Daudé #define FORBID_CLONE_FLAG(flag) \
708d7f2e76SPhilippe Mathieu-Daudé const struct scmp_arg_cmp clone_arg ## flag[] = { \
718d7f2e76SPhilippe Mathieu-Daudé { .arg = CLONE_FLAGS_ARG, \
728d7f2e76SPhilippe Mathieu-Daudé .op = SCMP_CMP_MASKED_EQ, \
738d7f2e76SPhilippe Mathieu-Daudé .datum_a = flag, .datum_b = flag } }
748d7f2e76SPhilippe Mathieu-Daudé
758d7f2e76SPhilippe Mathieu-Daudé #define RULE_CLONE_FLAG(flag) \
768d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(clone), QEMU_SECCOMP_SET_SPAWN, \
77e79f8b8bSDaniel P. Berrangé ARRAY_SIZE(clone_arg ## flag), clone_arg ## flag, SCMP_ACT_ERRNO(EPERM) }
788d7f2e76SPhilippe Mathieu-Daudé
798d7f2e76SPhilippe Mathieu-Daudé /* If no CLONE_* flags are set, except CSIGNAL, deny */
808d7f2e76SPhilippe Mathieu-Daudé const struct scmp_arg_cmp clone_arg_none[] = {
818d7f2e76SPhilippe Mathieu-Daudé { .arg = CLONE_FLAGS_ARG,
828d7f2e76SPhilippe Mathieu-Daudé .op = SCMP_CMP_MASKED_EQ,
838d7f2e76SPhilippe Mathieu-Daudé .datum_a = ~(CSIGNAL), .datum_b = 0 }
848d7f2e76SPhilippe Mathieu-Daudé };
858d7f2e76SPhilippe Mathieu-Daudé
868d7f2e76SPhilippe Mathieu-Daudé /*
878d7f2e76SPhilippe Mathieu-Daudé * pthread_create should always set all of these.
888d7f2e76SPhilippe Mathieu-Daudé */
898d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_VM);
908d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_FS);
918d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_FILES);
928d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_SIGHAND);
938d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_THREAD);
948d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_SYSVSEM);
958d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_SETTLS);
968d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_PARENT_SETTID);
978d7f2e76SPhilippe Mathieu-Daudé REQUIRE_CLONE_FLAG(CLONE_CHILD_CLEARTID);
988d7f2e76SPhilippe Mathieu-Daudé /*
998d7f2e76SPhilippe Mathieu-Daudé * Musl sets this in pthread_create too, but it is
1008d7f2e76SPhilippe Mathieu-Daudé * obsolete and harmless since its behaviour is
1018d7f2e76SPhilippe Mathieu-Daudé * subsumed under CLONE_THREAD
1028d7f2e76SPhilippe Mathieu-Daudé */
1038d7f2e76SPhilippe Mathieu-Daudé /*REQUIRE_CLONE_FLAG(CLONE_DETACHED);*/
1048d7f2e76SPhilippe Mathieu-Daudé
1058d7f2e76SPhilippe Mathieu-Daudé
1068d7f2e76SPhilippe Mathieu-Daudé /*
1078d7f2e76SPhilippe Mathieu-Daudé * These all indicate an attempt to spawn a process
1088d7f2e76SPhilippe Mathieu-Daudé * instead of a thread, or other undesirable scenarios
1098d7f2e76SPhilippe Mathieu-Daudé */
1108d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_PIDFD);
1118d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_PTRACE);
1128d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_VFORK);
1138d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_PARENT);
1148d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWNS);
1158d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_UNTRACED);
1168d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWCGROUP);
1178d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWUTS);
1188d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWIPC);
1198d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWUSER);
1208d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWPID);
1218d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_NEWNET);
1228d7f2e76SPhilippe Mathieu-Daudé FORBID_CLONE_FLAG(CLONE_IO);
1238d7f2e76SPhilippe Mathieu-Daudé
1248d7f2e76SPhilippe Mathieu-Daudé
1258d7f2e76SPhilippe Mathieu-Daudé static const struct QemuSeccompSyscall denylist[] = {
1268d7f2e76SPhilippe Mathieu-Daudé /* default set of syscalls that should get blocked */
1278d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(reboot), QEMU_SECCOMP_SET_DEFAULT,
1288d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1298d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(swapon), QEMU_SECCOMP_SET_DEFAULT,
1308d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1318d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(swapoff), QEMU_SECCOMP_SET_DEFAULT,
1328d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1338d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(syslog), QEMU_SECCOMP_SET_DEFAULT,
1348d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1358d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(mount), QEMU_SECCOMP_SET_DEFAULT,
1368d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1378d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(umount), QEMU_SECCOMP_SET_DEFAULT,
1388d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1398d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(kexec_load), QEMU_SECCOMP_SET_DEFAULT,
1408d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1418d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(afs_syscall), QEMU_SECCOMP_SET_DEFAULT,
1428d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1438d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(break), QEMU_SECCOMP_SET_DEFAULT,
1448d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1458d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(ftime), QEMU_SECCOMP_SET_DEFAULT,
1468d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1478d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(getpmsg), QEMU_SECCOMP_SET_DEFAULT,
1488d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1498d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(gtty), QEMU_SECCOMP_SET_DEFAULT,
1508d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1518d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(lock), QEMU_SECCOMP_SET_DEFAULT,
1528d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1538d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(mpx), QEMU_SECCOMP_SET_DEFAULT,
1548d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1558d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(prof), QEMU_SECCOMP_SET_DEFAULT,
1568d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1578d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(profil), QEMU_SECCOMP_SET_DEFAULT,
1588d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1598d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(putpmsg), QEMU_SECCOMP_SET_DEFAULT,
1608d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1618d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(security), QEMU_SECCOMP_SET_DEFAULT,
1628d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1638d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(stty), QEMU_SECCOMP_SET_DEFAULT,
1648d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1658d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(tuxcall), QEMU_SECCOMP_SET_DEFAULT,
1668d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1678d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(ulimit), QEMU_SECCOMP_SET_DEFAULT,
1688d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1698d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(vserver), QEMU_SECCOMP_SET_DEFAULT,
1708d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1718d7f2e76SPhilippe Mathieu-Daudé /* obsolete */
1728d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(readdir), QEMU_SECCOMP_SET_OBSOLETE,
1738d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1748d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(_sysctl), QEMU_SECCOMP_SET_OBSOLETE,
1758d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1768d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(bdflush), QEMU_SECCOMP_SET_OBSOLETE,
1778d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1788d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(create_module), QEMU_SECCOMP_SET_OBSOLETE,
1798d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1808d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(get_kernel_syms), QEMU_SECCOMP_SET_OBSOLETE,
1818d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1828d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(query_module), QEMU_SECCOMP_SET_OBSOLETE,
1838d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1848d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(sgetmask), QEMU_SECCOMP_SET_OBSOLETE,
1858d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1868d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(ssetmask), QEMU_SECCOMP_SET_OBSOLETE,
1878d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1888d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(sysfs), QEMU_SECCOMP_SET_OBSOLETE,
1898d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1908d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(uselib), QEMU_SECCOMP_SET_OBSOLETE,
1918d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1928d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(ustat), QEMU_SECCOMP_SET_OBSOLETE,
1938d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1948d7f2e76SPhilippe Mathieu-Daudé /* privileged */
1958d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setuid), QEMU_SECCOMP_SET_PRIVILEGED,
1968d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1978d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setgid), QEMU_SECCOMP_SET_PRIVILEGED,
1988d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
1998d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setpgid), QEMU_SECCOMP_SET_PRIVILEGED,
2008d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2018d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setsid), QEMU_SECCOMP_SET_PRIVILEGED,
2028d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2038d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setreuid), QEMU_SECCOMP_SET_PRIVILEGED,
2048d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2058d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setregid), QEMU_SECCOMP_SET_PRIVILEGED,
2068d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2078d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setresuid), QEMU_SECCOMP_SET_PRIVILEGED,
2088d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2098d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setresgid), QEMU_SECCOMP_SET_PRIVILEGED,
2108d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2118d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setfsuid), QEMU_SECCOMP_SET_PRIVILEGED,
2128d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2138d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setfsgid), QEMU_SECCOMP_SET_PRIVILEGED,
2148d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_TRAP },
2158d7f2e76SPhilippe Mathieu-Daudé /* spawn */
2168d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(fork), QEMU_SECCOMP_SET_SPAWN,
217e79f8b8bSDaniel P. Berrangé 0, NULL, SCMP_ACT_ERRNO(EPERM) },
2188d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(vfork), QEMU_SECCOMP_SET_SPAWN,
219e79f8b8bSDaniel P. Berrangé 0, NULL, SCMP_ACT_ERRNO(EPERM) },
2208d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(execve), QEMU_SECCOMP_SET_SPAWN,
221e79f8b8bSDaniel P. Berrangé 0, NULL, SCMP_ACT_ERRNO(EPERM) },
2228d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(clone), QEMU_SECCOMP_SET_SPAWN,
223e79f8b8bSDaniel P. Berrangé ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
2248d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_VM),
2258d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_FS),
2268d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_FILES),
2278d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_SIGHAND),
2288d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_THREAD),
2298d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_SYSVSEM),
2308d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_SETTLS),
2318d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_PARENT_SETTID),
2328d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_CHILD_CLEARTID),
2338d7f2e76SPhilippe Mathieu-Daudé /*RULE_CLONE_FLAG(CLONE_DETACHED),*/
2348d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_PIDFD),
2358d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_PTRACE),
2368d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_VFORK),
2378d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_PARENT),
2388d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWNS),
2398d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_UNTRACED),
2408d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWCGROUP),
2418d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWUTS),
2428d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWIPC),
2438d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWUSER),
2448d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWPID),
2458d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_NEWNET),
2468d7f2e76SPhilippe Mathieu-Daudé RULE_CLONE_FLAG(CLONE_IO),
2478d7f2e76SPhilippe Mathieu-Daudé #ifdef __SNR_clone3
2488d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(clone3), QEMU_SECCOMP_SET_SPAWN,
2498d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_ERRNO(ENOSYS) },
2508d7f2e76SPhilippe Mathieu-Daudé #endif
2518d7f2e76SPhilippe Mathieu-Daudé #ifdef __SNR_execveat
2528d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(execveat), QEMU_SECCOMP_SET_SPAWN },
2538d7f2e76SPhilippe Mathieu-Daudé #endif
2548d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setns), QEMU_SECCOMP_SET_SPAWN },
2558d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(unshare), QEMU_SECCOMP_SET_SPAWN },
2568d7f2e76SPhilippe Mathieu-Daudé /* resource control */
2578d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(setpriority), QEMU_SECCOMP_SET_RESOURCECTL,
2588d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_ERRNO(EPERM) },
2598d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(sched_setparam), QEMU_SECCOMP_SET_RESOURCECTL,
2608d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_ERRNO(EPERM) },
2618d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(sched_setscheduler), QEMU_SECCOMP_SET_RESOURCECTL,
2628d7f2e76SPhilippe Mathieu-Daudé ARRAY_SIZE(sched_setscheduler_arg), sched_setscheduler_arg,
2638d7f2e76SPhilippe Mathieu-Daudé SCMP_ACT_ERRNO(EPERM) },
2648d7f2e76SPhilippe Mathieu-Daudé { SCMP_SYS(sched_setaffinity), QEMU_SECCOMP_SET_RESOURCECTL,
2658d7f2e76SPhilippe Mathieu-Daudé 0, NULL, SCMP_ACT_ERRNO(EPERM) },
2668d7f2e76SPhilippe Mathieu-Daudé };
2678d7f2e76SPhilippe Mathieu-Daudé
2688d7f2e76SPhilippe Mathieu-Daudé static inline __attribute__((unused)) int
qemu_seccomp(unsigned int operation,unsigned int flags,void * args)2698d7f2e76SPhilippe Mathieu-Daudé qemu_seccomp(unsigned int operation, unsigned int flags, void *args)
2708d7f2e76SPhilippe Mathieu-Daudé {
2718d7f2e76SPhilippe Mathieu-Daudé #ifdef __NR_seccomp
2728d7f2e76SPhilippe Mathieu-Daudé return syscall(__NR_seccomp, operation, flags, args);
2738d7f2e76SPhilippe Mathieu-Daudé #else
2748d7f2e76SPhilippe Mathieu-Daudé errno = ENOSYS;
2758d7f2e76SPhilippe Mathieu-Daudé return -1;
2768d7f2e76SPhilippe Mathieu-Daudé #endif
2778d7f2e76SPhilippe Mathieu-Daudé }
2788d7f2e76SPhilippe Mathieu-Daudé
qemu_seccomp_update_action(uint32_t action)2798d7f2e76SPhilippe Mathieu-Daudé static uint32_t qemu_seccomp_update_action(uint32_t action)
2808d7f2e76SPhilippe Mathieu-Daudé {
2818d7f2e76SPhilippe Mathieu-Daudé #if defined(SECCOMP_GET_ACTION_AVAIL) && defined(SCMP_ACT_KILL_PROCESS) && \
2828d7f2e76SPhilippe Mathieu-Daudé defined(SECCOMP_RET_KILL_PROCESS)
2838d7f2e76SPhilippe Mathieu-Daudé if (action == SCMP_ACT_TRAP) {
2848d7f2e76SPhilippe Mathieu-Daudé static int kill_process = -1;
2858d7f2e76SPhilippe Mathieu-Daudé if (kill_process == -1) {
2868d7f2e76SPhilippe Mathieu-Daudé uint32_t testaction = SECCOMP_RET_KILL_PROCESS;
2878d7f2e76SPhilippe Mathieu-Daudé
2888d7f2e76SPhilippe Mathieu-Daudé if (qemu_seccomp(SECCOMP_GET_ACTION_AVAIL, 0, &testaction) == 0) {
2898d7f2e76SPhilippe Mathieu-Daudé kill_process = 1;
2908d7f2e76SPhilippe Mathieu-Daudé } else {
2918d7f2e76SPhilippe Mathieu-Daudé kill_process = 0;
2928d7f2e76SPhilippe Mathieu-Daudé }
2938d7f2e76SPhilippe Mathieu-Daudé }
2948d7f2e76SPhilippe Mathieu-Daudé if (kill_process == 1) {
2958d7f2e76SPhilippe Mathieu-Daudé return SCMP_ACT_KILL_PROCESS;
2968d7f2e76SPhilippe Mathieu-Daudé }
2978d7f2e76SPhilippe Mathieu-Daudé }
2988d7f2e76SPhilippe Mathieu-Daudé #endif
2998d7f2e76SPhilippe Mathieu-Daudé return action;
3008d7f2e76SPhilippe Mathieu-Daudé }
3018d7f2e76SPhilippe Mathieu-Daudé
3028d7f2e76SPhilippe Mathieu-Daudé
seccomp_start(uint32_t seccomp_opts,Error ** errp)3038d7f2e76SPhilippe Mathieu-Daudé static int seccomp_start(uint32_t seccomp_opts, Error **errp)
3048d7f2e76SPhilippe Mathieu-Daudé {
3058d7f2e76SPhilippe Mathieu-Daudé int rc = -1;
3068d7f2e76SPhilippe Mathieu-Daudé unsigned int i = 0;
3078d7f2e76SPhilippe Mathieu-Daudé scmp_filter_ctx ctx;
3088d7f2e76SPhilippe Mathieu-Daudé
3098d7f2e76SPhilippe Mathieu-Daudé ctx = seccomp_init(SCMP_ACT_ALLOW);
3108d7f2e76SPhilippe Mathieu-Daudé if (ctx == NULL) {
3118d7f2e76SPhilippe Mathieu-Daudé error_setg(errp, "failed to initialize seccomp context");
3128d7f2e76SPhilippe Mathieu-Daudé goto seccomp_return;
3138d7f2e76SPhilippe Mathieu-Daudé }
3148d7f2e76SPhilippe Mathieu-Daudé
3158d7f2e76SPhilippe Mathieu-Daudé #if defined(CONFIG_SECCOMP_SYSRAWRC)
3168d7f2e76SPhilippe Mathieu-Daudé /*
3178d7f2e76SPhilippe Mathieu-Daudé * This must be the first seccomp_attr_set() call to have full
3188d7f2e76SPhilippe Mathieu-Daudé * error propagation from subsequent seccomp APIs.
3198d7f2e76SPhilippe Mathieu-Daudé */
3208d7f2e76SPhilippe Mathieu-Daudé rc = seccomp_attr_set(ctx, SCMP_FLTATR_API_SYSRAWRC, 1);
3218d7f2e76SPhilippe Mathieu-Daudé if (rc != 0) {
3228d7f2e76SPhilippe Mathieu-Daudé error_setg_errno(errp, -rc,
3238d7f2e76SPhilippe Mathieu-Daudé "failed to set seccomp rawrc attribute");
3248d7f2e76SPhilippe Mathieu-Daudé goto seccomp_return;
3258d7f2e76SPhilippe Mathieu-Daudé }
3268d7f2e76SPhilippe Mathieu-Daudé #endif
3278d7f2e76SPhilippe Mathieu-Daudé
3288d7f2e76SPhilippe Mathieu-Daudé rc = seccomp_attr_set(ctx, SCMP_FLTATR_CTL_TSYNC, 1);
3298d7f2e76SPhilippe Mathieu-Daudé if (rc != 0) {
3308d7f2e76SPhilippe Mathieu-Daudé error_setg_errno(errp, -rc,
3318d7f2e76SPhilippe Mathieu-Daudé "failed to set seccomp thread synchronization");
3328d7f2e76SPhilippe Mathieu-Daudé goto seccomp_return;
3338d7f2e76SPhilippe Mathieu-Daudé }
3348d7f2e76SPhilippe Mathieu-Daudé
3358d7f2e76SPhilippe Mathieu-Daudé for (i = 0; i < ARRAY_SIZE(denylist); i++) {
3368d7f2e76SPhilippe Mathieu-Daudé uint32_t action;
3378d7f2e76SPhilippe Mathieu-Daudé if (!(seccomp_opts & denylist[i].set)) {
3388d7f2e76SPhilippe Mathieu-Daudé continue;
3398d7f2e76SPhilippe Mathieu-Daudé }
3408d7f2e76SPhilippe Mathieu-Daudé
3418d7f2e76SPhilippe Mathieu-Daudé action = qemu_seccomp_update_action(denylist[i].action);
3428d7f2e76SPhilippe Mathieu-Daudé rc = seccomp_rule_add_array(ctx, action, denylist[i].num,
3438d7f2e76SPhilippe Mathieu-Daudé denylist[i].narg, denylist[i].arg_cmp);
3448d7f2e76SPhilippe Mathieu-Daudé if (rc < 0) {
3458d7f2e76SPhilippe Mathieu-Daudé error_setg_errno(errp, -rc,
3468d7f2e76SPhilippe Mathieu-Daudé "failed to add seccomp denylist rules");
3478d7f2e76SPhilippe Mathieu-Daudé goto seccomp_return;
3488d7f2e76SPhilippe Mathieu-Daudé }
3498d7f2e76SPhilippe Mathieu-Daudé }
3508d7f2e76SPhilippe Mathieu-Daudé
3518d7f2e76SPhilippe Mathieu-Daudé rc = seccomp_load(ctx);
3528d7f2e76SPhilippe Mathieu-Daudé if (rc < 0) {
3538d7f2e76SPhilippe Mathieu-Daudé error_setg_errno(errp, -rc,
3548d7f2e76SPhilippe Mathieu-Daudé "failed to load seccomp syscall filter in kernel");
3558d7f2e76SPhilippe Mathieu-Daudé }
3568d7f2e76SPhilippe Mathieu-Daudé
3578d7f2e76SPhilippe Mathieu-Daudé seccomp_return:
3588d7f2e76SPhilippe Mathieu-Daudé seccomp_release(ctx);
3598d7f2e76SPhilippe Mathieu-Daudé return rc < 0 ? -1 : 0;
3608d7f2e76SPhilippe Mathieu-Daudé }
3618d7f2e76SPhilippe Mathieu-Daudé
parse_sandbox(void * opaque,QemuOpts * opts,Error ** errp)3628d7f2e76SPhilippe Mathieu-Daudé int parse_sandbox(void *opaque, QemuOpts *opts, Error **errp)
3638d7f2e76SPhilippe Mathieu-Daudé {
3648d7f2e76SPhilippe Mathieu-Daudé if (qemu_opt_get_bool(opts, "enable", false)) {
3658d7f2e76SPhilippe Mathieu-Daudé uint32_t seccomp_opts = QEMU_SECCOMP_SET_DEFAULT
3668d7f2e76SPhilippe Mathieu-Daudé | QEMU_SECCOMP_SET_OBSOLETE;
3678d7f2e76SPhilippe Mathieu-Daudé const char *value = NULL;
3688d7f2e76SPhilippe Mathieu-Daudé
3698d7f2e76SPhilippe Mathieu-Daudé value = qemu_opt_get(opts, "obsolete");
3708d7f2e76SPhilippe Mathieu-Daudé if (value) {
3718d7f2e76SPhilippe Mathieu-Daudé if (g_str_equal(value, "allow")) {
3728d7f2e76SPhilippe Mathieu-Daudé seccomp_opts &= ~QEMU_SECCOMP_SET_OBSOLETE;
3738d7f2e76SPhilippe Mathieu-Daudé } else if (g_str_equal(value, "deny")) {
3748d7f2e76SPhilippe Mathieu-Daudé /* this is the default option, this if is here
3758d7f2e76SPhilippe Mathieu-Daudé * to provide a little bit of consistency for
3768d7f2e76SPhilippe Mathieu-Daudé * the command line */
3778d7f2e76SPhilippe Mathieu-Daudé } else {
3788d7f2e76SPhilippe Mathieu-Daudé error_setg(errp, "invalid argument for obsolete");
3798d7f2e76SPhilippe Mathieu-Daudé return -1;
3808d7f2e76SPhilippe Mathieu-Daudé }
3818d7f2e76SPhilippe Mathieu-Daudé }
3828d7f2e76SPhilippe Mathieu-Daudé
3838d7f2e76SPhilippe Mathieu-Daudé value = qemu_opt_get(opts, "elevateprivileges");
3848d7f2e76SPhilippe Mathieu-Daudé if (value) {
3858d7f2e76SPhilippe Mathieu-Daudé if (g_str_equal(value, "deny")) {
3868d7f2e76SPhilippe Mathieu-Daudé seccomp_opts |= QEMU_SECCOMP_SET_PRIVILEGED;
3878d7f2e76SPhilippe Mathieu-Daudé } else if (g_str_equal(value, "children")) {
3888d7f2e76SPhilippe Mathieu-Daudé seccomp_opts |= QEMU_SECCOMP_SET_PRIVILEGED;
3898d7f2e76SPhilippe Mathieu-Daudé
3908d7f2e76SPhilippe Mathieu-Daudé /* calling prctl directly because we're
3918d7f2e76SPhilippe Mathieu-Daudé * not sure if host has CAP_SYS_ADMIN set*/
3928d7f2e76SPhilippe Mathieu-Daudé if (prctl(PR_SET_NO_NEW_PRIVS, 1)) {
3938d7f2e76SPhilippe Mathieu-Daudé error_setg(errp, "failed to set no_new_privs aborting");
3948d7f2e76SPhilippe Mathieu-Daudé return -1;
3958d7f2e76SPhilippe Mathieu-Daudé }
3968d7f2e76SPhilippe Mathieu-Daudé } else if (g_str_equal(value, "allow")) {
3978d7f2e76SPhilippe Mathieu-Daudé /* default value */
3988d7f2e76SPhilippe Mathieu-Daudé } else {
3998d7f2e76SPhilippe Mathieu-Daudé error_setg(errp, "invalid argument for elevateprivileges");
4008d7f2e76SPhilippe Mathieu-Daudé return -1;
4018d7f2e76SPhilippe Mathieu-Daudé }
4028d7f2e76SPhilippe Mathieu-Daudé }
4038d7f2e76SPhilippe Mathieu-Daudé
4048d7f2e76SPhilippe Mathieu-Daudé value = qemu_opt_get(opts, "spawn");
4058d7f2e76SPhilippe Mathieu-Daudé if (value) {
4068d7f2e76SPhilippe Mathieu-Daudé if (g_str_equal(value, "deny")) {
4078d7f2e76SPhilippe Mathieu-Daudé seccomp_opts |= QEMU_SECCOMP_SET_SPAWN;
4088d7f2e76SPhilippe Mathieu-Daudé } else if (g_str_equal(value, "allow")) {
4098d7f2e76SPhilippe Mathieu-Daudé /* default value */
4108d7f2e76SPhilippe Mathieu-Daudé } else {
4118d7f2e76SPhilippe Mathieu-Daudé error_setg(errp, "invalid argument for spawn");
4128d7f2e76SPhilippe Mathieu-Daudé return -1;
4138d7f2e76SPhilippe Mathieu-Daudé }
4148d7f2e76SPhilippe Mathieu-Daudé }
4158d7f2e76SPhilippe Mathieu-Daudé
4168d7f2e76SPhilippe Mathieu-Daudé value = qemu_opt_get(opts, "resourcecontrol");
4178d7f2e76SPhilippe Mathieu-Daudé if (value) {
4188d7f2e76SPhilippe Mathieu-Daudé if (g_str_equal(value, "deny")) {
4198d7f2e76SPhilippe Mathieu-Daudé seccomp_opts |= QEMU_SECCOMP_SET_RESOURCECTL;
4208d7f2e76SPhilippe Mathieu-Daudé } else if (g_str_equal(value, "allow")) {
4218d7f2e76SPhilippe Mathieu-Daudé /* default value */
4228d7f2e76SPhilippe Mathieu-Daudé } else {
4238d7f2e76SPhilippe Mathieu-Daudé error_setg(errp, "invalid argument for resourcecontrol");
4248d7f2e76SPhilippe Mathieu-Daudé return -1;
4258d7f2e76SPhilippe Mathieu-Daudé }
4268d7f2e76SPhilippe Mathieu-Daudé }
4278d7f2e76SPhilippe Mathieu-Daudé
4288d7f2e76SPhilippe Mathieu-Daudé if (seccomp_start(seccomp_opts, errp) < 0) {
4298d7f2e76SPhilippe Mathieu-Daudé return -1;
4308d7f2e76SPhilippe Mathieu-Daudé }
4318d7f2e76SPhilippe Mathieu-Daudé }
4328d7f2e76SPhilippe Mathieu-Daudé
4338d7f2e76SPhilippe Mathieu-Daudé return 0;
4348d7f2e76SPhilippe Mathieu-Daudé }
4358d7f2e76SPhilippe Mathieu-Daudé
4368d7f2e76SPhilippe Mathieu-Daudé static QemuOptsList qemu_sandbox_opts = {
4378d7f2e76SPhilippe Mathieu-Daudé .name = "sandbox",
4388d7f2e76SPhilippe Mathieu-Daudé .implied_opt_name = "enable",
4398d7f2e76SPhilippe Mathieu-Daudé .head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head),
4408d7f2e76SPhilippe Mathieu-Daudé .desc = {
4418d7f2e76SPhilippe Mathieu-Daudé {
4428d7f2e76SPhilippe Mathieu-Daudé .name = "enable",
4438d7f2e76SPhilippe Mathieu-Daudé .type = QEMU_OPT_BOOL,
4448d7f2e76SPhilippe Mathieu-Daudé },
4458d7f2e76SPhilippe Mathieu-Daudé {
4468d7f2e76SPhilippe Mathieu-Daudé .name = "obsolete",
4478d7f2e76SPhilippe Mathieu-Daudé .type = QEMU_OPT_STRING,
4488d7f2e76SPhilippe Mathieu-Daudé },
4498d7f2e76SPhilippe Mathieu-Daudé {
4508d7f2e76SPhilippe Mathieu-Daudé .name = "elevateprivileges",
4518d7f2e76SPhilippe Mathieu-Daudé .type = QEMU_OPT_STRING,
4528d7f2e76SPhilippe Mathieu-Daudé },
4538d7f2e76SPhilippe Mathieu-Daudé {
4548d7f2e76SPhilippe Mathieu-Daudé .name = "spawn",
4558d7f2e76SPhilippe Mathieu-Daudé .type = QEMU_OPT_STRING,
4568d7f2e76SPhilippe Mathieu-Daudé },
4578d7f2e76SPhilippe Mathieu-Daudé {
4588d7f2e76SPhilippe Mathieu-Daudé .name = "resourcecontrol",
4598d7f2e76SPhilippe Mathieu-Daudé .type = QEMU_OPT_STRING,
4608d7f2e76SPhilippe Mathieu-Daudé },
4618d7f2e76SPhilippe Mathieu-Daudé { /* end of list */ }
4628d7f2e76SPhilippe Mathieu-Daudé },
4638d7f2e76SPhilippe Mathieu-Daudé };
4648d7f2e76SPhilippe Mathieu-Daudé
seccomp_register(void)4658d7f2e76SPhilippe Mathieu-Daudé static void seccomp_register(void)
4668d7f2e76SPhilippe Mathieu-Daudé {
4678d7f2e76SPhilippe Mathieu-Daudé bool add = false;
4688d7f2e76SPhilippe Mathieu-Daudé
4698d7f2e76SPhilippe Mathieu-Daudé /* FIXME: use seccomp_api_get() >= 2 check when released */
4708d7f2e76SPhilippe Mathieu-Daudé
4718d7f2e76SPhilippe Mathieu-Daudé #if defined(SECCOMP_FILTER_FLAG_TSYNC)
4728d7f2e76SPhilippe Mathieu-Daudé int check;
4738d7f2e76SPhilippe Mathieu-Daudé
4748d7f2e76SPhilippe Mathieu-Daudé /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */
4758d7f2e76SPhilippe Mathieu-Daudé check = qemu_seccomp(SECCOMP_SET_MODE_FILTER,
4768d7f2e76SPhilippe Mathieu-Daudé SECCOMP_FILTER_FLAG_TSYNC, NULL);
4778d7f2e76SPhilippe Mathieu-Daudé if (check < 0 && errno == EFAULT) {
4788d7f2e76SPhilippe Mathieu-Daudé add = true;
4798d7f2e76SPhilippe Mathieu-Daudé }
4808d7f2e76SPhilippe Mathieu-Daudé #endif
4818d7f2e76SPhilippe Mathieu-Daudé
4828d7f2e76SPhilippe Mathieu-Daudé if (add) {
4838d7f2e76SPhilippe Mathieu-Daudé qemu_add_opts(&qemu_sandbox_opts);
4848d7f2e76SPhilippe Mathieu-Daudé }
4858d7f2e76SPhilippe Mathieu-Daudé }
4868d7f2e76SPhilippe Mathieu-Daudé opts_init(seccomp_register);
487