On Friday, August 30, 2013 11:27:28 AM Eduardo Otubo wrote: > On 08/29/2013 09:56 AM, Paul Moore wrote: > > On Wednesday, August 28, 2013 10:04:32 PM Eduardo Otubo wrote: > >> Now there's a second whitelist, right before the vcpu starts. The second > >> whitelist is the same as the first one, except for exec() and select(). > >> > >> Signed-off-by: Eduardo Otubo <ot...@linux.vnet.ibm.com> > > > > We talked about this in a previous thread, but as a reminder, the kernel's > > seccomp BPF filter works by executing all of the loaded filters for each > > syscall and taking the least permissive action for all of the results. In > > other words, if one filter returns ALLOW for a given syscall and another > > filter returns KILL, the kernel will select the KILL action for the > > syscall. > > > > With that in mind, I think the best option is to keep the existing > > whitelist and instead of creating a second whitelist, create a second > > *blacklist* that removes the syscalls you don't want to allow anymore, > > e.g. exec() and select(). This approach should be easier to maintain and > > would result in less overhead in the kernel's seccomp evaluator (the > > blacklist filter would be much smaller than a second whitelist filter). > > You're correct. I was thinking in a whole other approach, but your point > makes a lot more sense. As I mentioned on the IRC, I should call > seccomp_init(SCMP_ACT_ALLOW) and seccomp_rule_add(ctx, SCMP_ACT_KILL, > list[i].num, 0); is that correct?
Yes, just basically swap the actions. Also, as an FYI, while I may be in the IRC room, I typically don't actually monitor the room unless you direct a comment at me (it starts blinking and grabs my attention). -- paul moore security and virtualization @ redhat