Commit 7d76ad4f authored by Eduardo Otubo's avatar Eduardo Otubo Committed by Anthony Liguori
Browse files

Command line support for seccomp with -sandbox (v8) 



Signed-off-by: default avatarEduardo Otubo <otubo@linux.vnet.ibm.com>
Signed-off-by: default avatarAnthony Liguori <aliguori@us.ibm.com>
---
v7 -> v8
 - Parse options correctly (aliguori)
parent 452dfbef

qemu-config.c

+14 −0
Original line number Diff line number Diff line
@@ -362,6 +362,19 @@ static QemuOptsList qemu_global_opts = { 
    },

};



QemuOptsList qemu_sandbox_opts = {

    .name = "sandbox",

    .implied_opt_name = "enable",

    .head = QTAILQ_HEAD_INITIALIZER(qemu_sandbox_opts.head),

    .desc = {

        {

            .name = "enable",

            .type = QEMU_OPT_BOOL,

        },

        { /* end of list */ }

    },

};



static QemuOptsList qemu_mon_opts = {

    .name = "mon",

    .implied_opt_name = "chardev",
@@ -645,6 +658,7 @@ static QemuOptsList *vm_config_groups[32] = { 
    &qemu_machine_opts,

    &qemu_boot_opts,

    &qemu_iscsi_opts,

    &qemu_sandbox_opts,

    NULL,

};

qemu-config.h

+1 −0
Original line number Diff line number Diff line
@@ -6,6 +6,7 @@ 
extern QemuOptsList qemu_fsdev_opts;

extern QemuOptsList qemu_virtfs_opts;

extern QemuOptsList qemu_spice_opts;

extern QemuOptsList qemu_sandbox_opts;



QemuOptsList *qemu_find_opts(const char *group);

QemuOptsList *qemu_find_opts_err(const char *group, Error **errp);

qemu-options.hx

+10 −0
Original line number Diff line number Diff line
@@ -2723,6 +2723,16 @@ STEXI 
Old param mode (ARM only).

ETEXI



DEF("sandbox", HAS_ARG, QEMU_OPTION_sandbox, \

    "-sandbox <arg>  Enable seccomp mode 2 system call filter (default 'off').\n",

    QEMU_ARCH_ALL)

STEXI

@item -sandbox

@findex -sandbox

Enable Seccomp mode 2 system call filter. 'on' will enable syscall filtering and 'off' will

disable it.  The default is 'off'.

ETEXI



DEF("readconfig", HAS_ARG, QEMU_OPTION_readconfig,

    "-readconfig <file>\n", QEMU_ARCH_ALL)

STEXI

vl.c

+30 −8
Original line number Diff line number Diff line
@@ -770,6 +770,26 @@ static int bt_parse(const char *opt) 
    return 1;

}



static int parse_sandbox(QemuOpts *opts, void *opaque)

{

    /* FIXME: change this to true for 1.3 */

    if (qemu_opt_get_bool(opts, "enable", false)) {

#ifdef CONFIG_SECCOMP

        if (seccomp_start() < 0) {

            qerror_report(ERROR_CLASS_GENERIC_ERROR,

                          "failed to install seccomp syscall filter in the kernel");

            return -1;

        }

#else

        qerror_report(ERROR_CLASS_GENERIC_ERROR,

                      "sandboxing request but seccomp is not compiled into this build");

        return -1;

#endif

    }



    return 0;

}



/***********************************************************/

/* QEMU Block devices */
@@ -2349,14 +2369,6 @@ int main(int argc, char **argv, char **envp) 
    const char *trace_events = NULL;

    const char *trace_file = NULL;



#ifdef CONFIG_SECCOMP

    if (seccomp_start() < 0) {

        fprintf(stderr,

                "seccomp: failed to install syscall filter in the kernel\n");

        exit(1);

    }

#endif



    atexit(qemu_run_exit_notifiers);

    error_set_progname(argv[0]);
@@ -3260,6 +3272,12 @@ int main(int argc, char **argv, char **envp) 
            case QEMU_OPTION_qtest_log:

                qtest_log = optarg;

                break;

            case QEMU_OPTION_sandbox:

                opts = qemu_opts_parse(qemu_find_opts("sandbox"), optarg, 1);

                if (!opts) {

                    exit(0);

                }

                break;

            default:

                os_parse_cmd_args(popt->index, optarg);

            }
@@ -3267,6 +3285,10 @@ int main(int argc, char **argv, char **envp) 
    }

    loc_set_none();



    if (qemu_opts_foreach(qemu_find_opts("sandbox"), parse_sandbox, NULL, 0)) {

        exit(1);

    }



    if (machine == NULL) {

        fprintf(stderr, "No machine found.\n");

        exit(1);