From: Paul Moore <pmoore@redhat.com>
To: Andrew Jones <drjones@redhat.com>
Cc: "Peter Maydell" <peter.maydell@linaro.org>,
"Marcus Meissner" <meissner@suse.de>,
"Karl-Philipp Richter" <krichter722@aol.de>,
"Patch Tracking" <patches@linaro.org>,
"Riku Voipio" <riku.voipio@iki.fi>,
"Alexander Graf" <agraf@suse.de>,
"QEMU Developers" <qemu-devel@nongnu.org>,
"Eduardo Otubo" <eduardo.otubo@profitbricks.com>,
"Andreas Färber" <afaerber@suse.de>
Subject: Re: [Qemu-devel] [PATCH for-2.3] Revert seccomp tests that allow it to be used on non-x86 architectures
Date: Fri, 26 Jun 2015 16:26:22 -0400 [thread overview]
Message-ID: <17948100.v63oBISXG4@sifl> (raw)
In-Reply-To: <20150626160318.GC3215@hawk.localdomain>
On Friday, June 26, 2015 06:03:18 PM Andrew Jones wrote:
> On Tue, Jun 16, 2015 at 02:16:03PM +0100, Peter Maydell wrote:
> > On 16 June 2015 at 14:12, Andrew Jones <drjones@redhat.com> wrote:
> > > Can we now revert this revert, along with bumping the non-x86 arch
> > > atleast-version to v2.2.1
> >
> > Probably. I suggest you submit a patch and test it on the
> > relevant architectures and seccomp versions.
>
> I don't see any problems with the light testing (booting a guest)
> I've done on my mustang, but AArch64 worked with libseccomp 2.2.0
> too. So I dusted off my Midway (updated to Fedora 21 that has
> libseccomp 2.2.1 packaged), and gave it a try, but unfortunately
> it still doesn't work...
>
> I found that we needed to add another syscall to the whitelist;
> the arm-private 'cacheflush', as it's used by __builtin___clear_cache.
> And, from libseccomp's git history it appears that syscall is known
>
> commit a710a2d246bdc73ba77e3ff5624e790688cc51fd
> Author: Paul Moore <pmoore@redhat.com>
> Date: Wed May 6 12:05:45 2015 -0400
>
> arm: add some missing syscalls
>
> Add the following syscalls to the ARM arch/ABI and update the syscall
> validation script.
>
> * breakpoint()
> * cacheflush()
> * usr26()
> * usr32()
> * set_tls()
>
> Reported-by: Purcareata Bogdan <b43198@freescale.com>
> Signed-off-by: Paul Moore <pmoore@redhat.com>
>
>
> And also appears to be in 2.2.1
> $ git describe a710a2d246bdc73ba77e3ff5624e790688cc51fd
> v2.2.0-10-ga710a2d246bdc
>
> However the qemu thread that makes that syscall still dies, even
> with this patch
>
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index f9de0d3390feb..33644a4e3c3d3 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -237,7 +237,8 @@ static const struct QemuSeccompSyscall
> seccomp_whitelist[] = {
> { SCMP_SYS(fadvise64), 240 },
> { SCMP_SYS(inotify_init1), 240 },
> { SCMP_SYS(inotify_add_watch), 240 },
> - { SCMP_SYS(mbind), 240 }
> + { SCMP_SYS(mbind), 240 },
> + { SCMP_SYS(cacheflush), 240 },
> };
>
> int seccomp_start(void)
>
>
> Paul, can you help me figure out what I'm missing?
Perhaps a stupid question, but you did verify that it is cacheflush that is
causing the problem? The seccomp filter code will emit a message to syslog or
the audit log, depending on your configuration, with the syscall number.
#./tools/scmp_sys_resolver -a arm cacheflush
983042
#./tools/scmp_sys_resolver -a arm 983042
--
paul moore
security @ redhat
next prev parent reply other threads:[~2015-06-26 20:26 UTC|newest]
Thread overview: 15+ messages / expand[flat|nested] mbox.gz Atom feed top
2015-04-10 12:58 [Qemu-devel] [PATCH for-2.3] Revert seccomp tests that allow it to be used on non-x86 architectures Peter Maydell
2015-06-16 13:12 ` Andrew Jones
2015-06-16 13:16 ` Peter Maydell
2015-06-26 16:03 ` Andrew Jones
2015-06-26 20:26 ` Paul Moore [this message]
2015-06-29 7:50 ` Andrew Jones
2015-06-29 14:53 ` Paul Moore
2015-06-29 17:47 ` Andrew Jones
2015-06-29 20:24 ` Paul Moore
2015-06-30 8:39 ` Andrew Jones
2015-06-30 17:01 ` Paul Moore
2015-06-30 17:07 ` Peter Maydell
2015-06-30 17:18 ` Paul Moore
2015-07-01 12:07 ` Andrew Jones
2015-07-01 17:08 ` Paul Moore
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to=17948100.v63oBISXG4@sifl \
--to=pmoore@redhat.com \
--cc=afaerber@suse.de \
--cc=agraf@suse.de \
--cc=drjones@redhat.com \
--cc=eduardo.otubo@profitbricks.com \
--cc=krichter722@aol.de \
--cc=meissner@suse.de \
--cc=patches@linaro.org \
--cc=peter.maydell@linaro.org \
--cc=qemu-devel@nongnu.org \
--cc=riku.voipio@iki.fi \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.