From 02d63149fe6dbc26c35787d3f75e5ddeda0f4ecb Mon Sep 17 00:00:00 2001
From: Bo Chen <chen.bo@intel.com>
Date: Mon, 17 Aug 2020 21:30:53 -0700
Subject: [PATCH] virtio-devices: seccomp: Add seccomp filters for vhost_fs
 thread

This patch enables the seccomp filters for the vhost_fs worker thread.

Partially fixes: #925

Signed-off-by: Bo Chen <chen.bo@intel.com>
---
 virtio-devices/src/seccomp_filters.rs | 27 +++++++++++++++++++++++++++
 virtio-devices/src/vhost_user/fs.rs   | 14 ++++++++++++--
 vmm/src/device_manager.rs             |  1 +
 3 files changed, 40 insertions(+), 2 deletions(-)

diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs
index ea1e2cd16..cd094db53 100644
--- a/virtio-devices/src/seccomp_filters.rs
+++ b/virtio-devices/src/seccomp_filters.rs
@@ -19,6 +19,7 @@ pub enum Thread {
     VirtioNetCtl,
     VirtioPmem,
     VirtioRng,
+    VirtioVhostFs,
 }
 
 fn virtio_balloon_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
@@ -228,6 +229,30 @@ fn virtio_rng_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
     ])
 }
 
+fn virtio_vhost_fs_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
+    Ok(vec![
+        allow_syscall(libc::SYS_brk),
+        allow_syscall(libc::SYS_close),
+        allow_syscall(libc::SYS_dup),
+        allow_syscall(libc::SYS_epoll_create1),
+        allow_syscall(libc::SYS_epoll_ctl),
+        allow_syscall(libc::SYS_epoll_pwait),
+        #[cfg(target_arch = "x86_64")]
+        allow_syscall(libc::SYS_epoll_wait),
+        allow_syscall(libc::SYS_exit),
+        allow_syscall(libc::SYS_futex),
+        allow_syscall(libc::SYS_madvise),
+        allow_syscall(libc::SYS_mmap),
+        allow_syscall(libc::SYS_munmap),
+        allow_syscall(libc::SYS_read),
+        allow_syscall(libc::SYS_recvmsg),
+        allow_syscall(libc::SYS_rt_sigprocmask),
+        allow_syscall(libc::SYS_sendmsg),
+        allow_syscall(libc::SYS_sigaltstack),
+        allow_syscall(libc::SYS_write),
+    ])
+}
+
 fn get_seccomp_filter_trap(thread_type: Thread) -> Result<SeccompFilter, Error> {
     let rules = match thread_type {
         Thread::VirtioBalloon => virtio_balloon_thread_rules()?,
@@ -239,6 +264,7 @@ fn get_seccomp_filter_trap(thread_type: Thread) -> Result<SeccompFilter, Error>
         Thread::VirtioNetCtl => virtio_net_ctl_thread_rules()?,
         Thread::VirtioPmem => virtio_pmem_thread_rules()?,
         Thread::VirtioRng => virtio_rng_thread_rules()?,
+        Thread::VirtioVhostFs => virtio_vhost_fs_thread_rules()?,
     };
 
     Ok(SeccompFilter::new(
@@ -258,6 +284,7 @@ fn get_seccomp_filter_log(thread_type: Thread) -> Result<SeccompFilter, Error> {
         Thread::VirtioNetCtl => virtio_net_ctl_thread_rules()?,
         Thread::VirtioPmem => virtio_pmem_thread_rules()?,
         Thread::VirtioRng => virtio_rng_thread_rules()?,
+        Thread::VirtioVhostFs => virtio_vhost_fs_thread_rules()?,
     };
 
     Ok(SeccompFilter::new(
diff --git a/virtio-devices/src/vhost_user/fs.rs b/virtio-devices/src/vhost_user/fs.rs
index 09ce53bd1..024e0a933 100644
--- a/virtio-devices/src/vhost_user/fs.rs
+++ b/virtio-devices/src/vhost_user/fs.rs
@@ -3,12 +3,14 @@
 
 use super::vu_common_ctrl::{reset_vhost_user, setup_vhost_user, update_mem_table};
 use super::{Error, Result};
+use crate::seccomp_filters::{get_seccomp_filter, Thread};
 use crate::vhost_user::handler::{VhostUserEpollConfig, VhostUserEpollHandler};
 use crate::{
     ActivateError, ActivateResult, Queue, UserspaceMapping, VirtioDevice, VirtioDeviceType,
     VirtioInterrupt, VirtioSharedMemoryList, VIRTIO_F_VERSION_1,
 };
 use libc::{self, c_void, off64_t, pread64, pwrite64, EFD_NONBLOCK};
+use seccomp::{SeccompAction, SeccompFilter};
 use std::io;
 use std::os::unix::io::{AsRawFd, RawFd};
 use std::result;
@@ -281,6 +283,7 @@ pub struct Fs {
     epoll_threads: Option<Vec<thread::JoinHandle<()>>>,
     paused: Arc<AtomicBool>,
     paused_sync: Arc<Barrier>,
+    seccomp_action: SeccompAction,
 }
 
 impl Fs {
@@ -292,6 +295,7 @@ impl Fs {
         req_num_queues: usize,
         queue_size: u16,
         cache: Option<(VirtioSharedMemoryList, MmapRegion)>,
+        seccomp_action: SeccompAction,
     ) -> Result<Fs> {
         let mut slave_req_support = false;
 
@@ -367,6 +371,7 @@ impl Fs {
             epoll_threads: None,
             paused: Arc::new(AtomicBool::new(false)),
             paused_sync: Arc::new(Barrier::new(2)),
+            seccomp_action,
         })
     }
 }
@@ -504,10 +509,15 @@ impl VirtioDevice for Fs {
         let paused = self.paused.clone();
         let paused_sync = self.paused_sync.clone();
         let mut epoll_threads = Vec::new();
+        let virtio_vhost_fs_seccomp_filter =
+            get_seccomp_filter(&self.seccomp_action, Thread::VirtioVhostFs)
+                .map_err(ActivateError::CreateSeccompFilter)?;
         thread::Builder::new()
-            .name("virtio_fs".to_string())
+            .name("vhost_fs".to_string())
             .spawn(move || {
-                if let Err(e) = handler.run(paused, paused_sync) {
+                if let Err(e) = SeccompFilter::apply(virtio_vhost_fs_seccomp_filter) {
+                    error!("Error applying seccomp filter: {:?}", e);
+                } else if let Err(e) = handler.run(paused, paused_sync) {
                     error!("Error running worker: {:?}", e);
                 }
             })
diff --git a/vmm/src/device_manager.rs b/vmm/src/device_manager.rs
index ec7c65710..068e151db 100644
--- a/vmm/src/device_manager.rs
+++ b/vmm/src/device_manager.rs
@@ -2121,6 +2121,7 @@ impl DeviceManager {
                     fs_cfg.num_queues,
                     fs_cfg.queue_size,
                     cache,
+                    self.seccomp_action.clone(),
                 )
                 .map_err(DeviceManagerError::CreateVirtioFs)?,
             ));