From 02d87833f0a07436c7a7a3dd5d96e82c17df7ba3 Mon Sep 17 00:00:00 2001 From: Bo Chen Date: Mon, 17 Aug 2020 21:59:27 -0700 Subject: [PATCH] virtio-devices: seccomp: Add seccomp filters for vhost_blk thread This patch enables the seccomp filters for the vhost_blk worker thread. Partially fixes: #925 Signed-off-by: Bo Chen --- virtio-devices/src/seccomp_filters.rs | 24 ++++++++++++++++++++++++ virtio-devices/src/vhost_user/blk.rs | 15 ++++++++++++--- vmm/src/device_manager.rs | 8 ++++++-- 3 files changed, 42 insertions(+), 5 deletions(-) diff --git a/virtio-devices/src/seccomp_filters.rs b/virtio-devices/src/seccomp_filters.rs index f86fbb2df..af51048b3 100644 --- a/virtio-devices/src/seccomp_filters.rs +++ b/virtio-devices/src/seccomp_filters.rs @@ -19,6 +19,7 @@ pub enum Thread { VirtioNetCtl, VirtioPmem, VirtioRng, + VirtioVhostBlk, VirtioVhostFs, VirtioVhostNet, VirtioVhostNetCtl, @@ -231,6 +232,27 @@ fn virtio_rng_thread_rules() -> Result, Error> { ]) } +fn virtio_vhost_blk_thread_rules() -> Result, Error> { + Ok(vec![ + allow_syscall(libc::SYS_brk), + allow_syscall(libc::SYS_close), + allow_syscall(libc::SYS_dup), + allow_syscall(libc::SYS_epoll_create1), + allow_syscall(libc::SYS_epoll_ctl), + allow_syscall(libc::SYS_epoll_pwait), + #[cfg(target_arch = "x86_64")] + allow_syscall(libc::SYS_epoll_wait), + allow_syscall(libc::SYS_exit), + allow_syscall(libc::SYS_futex), + allow_syscall(libc::SYS_madvise), + allow_syscall(libc::SYS_munmap), + allow_syscall(libc::SYS_read), + allow_syscall(libc::SYS_rt_sigprocmask), + allow_syscall(libc::SYS_sigaltstack), + allow_syscall(libc::SYS_write), + ]) +} + fn virtio_vhost_fs_thread_rules() -> Result, Error> { Ok(vec![ allow_syscall(libc::SYS_brk), @@ -295,6 +317,7 @@ fn get_seccomp_filter_trap(thread_type: Thread) -> Result Thread::VirtioNetCtl => virtio_net_ctl_thread_rules()?, Thread::VirtioPmem => virtio_pmem_thread_rules()?, Thread::VirtioRng => virtio_rng_thread_rules()?, + Thread::VirtioVhostBlk => virtio_vhost_blk_thread_rules()?, Thread::VirtioVhostFs => virtio_vhost_fs_thread_rules()?, Thread::VirtioVhostNet => virtio_vhost_net_thread_rules()?, Thread::VirtioVhostNetCtl => virtio_vhost_net_ctl_thread_rules()?, @@ -317,6 +340,7 @@ fn get_seccomp_filter_log(thread_type: Thread) -> Result { Thread::VirtioNetCtl => virtio_net_ctl_thread_rules()?, Thread::VirtioPmem => virtio_pmem_thread_rules()?, Thread::VirtioRng => virtio_rng_thread_rules()?, + Thread::VirtioVhostBlk => virtio_vhost_blk_thread_rules()?, Thread::VirtioVhostFs => virtio_vhost_fs_thread_rules()?, Thread::VirtioVhostNet => virtio_vhost_net_thread_rules()?, Thread::VirtioVhostNetCtl => virtio_vhost_net_ctl_thread_rules()?, diff --git a/virtio-devices/src/vhost_user/blk.rs b/virtio-devices/src/vhost_user/blk.rs index e3a9d2114..beddd1df2 100644 --- a/virtio-devices/src/vhost_user/blk.rs +++ b/virtio-devices/src/vhost_user/blk.rs @@ -5,9 +5,11 @@ use super::super::{ActivateError, ActivateResult, Queue, VirtioDevice, VirtioDev use super::handler::*; use super::vu_common_ctrl::*; use super::{Error, Result}; +use crate::seccomp_filters::{get_seccomp_filter, Thread}; use crate::VirtioInterrupt; use block_util::VirtioBlockConfig; use libc::EFD_NONBLOCK; +use seccomp::{SeccompAction, SeccompFilter}; use std::mem; use std::os::unix::io::AsRawFd; use std::result; @@ -43,11 +45,12 @@ pub struct Blk { epoll_threads: Option>>, paused: Arc, paused_sync: Arc, + seccomp_action: SeccompAction, } impl Blk { /// Create a new vhost-user-blk device - pub fn new(id: String, vu_cfg: VhostUserConfig) -> Result { + pub fn new(id: String, vu_cfg: VhostUserConfig, seccomp_action: SeccompAction) -> Result { let mut vhost_user_blk = Master::connect(&vu_cfg.socket, vu_cfg.num_queues as u64) .map_err(Error::VhostUserCreateMaster)?; @@ -148,6 +151,7 @@ impl Blk { epoll_threads: None, paused: Arc::new(AtomicBool::new(false)), paused_sync: Arc::new(Barrier::new(vu_cfg.num_queues + 1)), + seccomp_action, }) } } @@ -274,10 +278,15 @@ impl VirtioDevice for Blk { let paused = self.paused.clone(); let paused_sync = self.paused_sync.clone(); + let virtio_vhost_blk_seccomp_filter = + get_seccomp_filter(&self.seccomp_action, Thread::VirtioVhostBlk) + .map_err(ActivateError::CreateSeccompFilter)?; thread::Builder::new() - .name("vhost_user_blk".to_string()) + .name("vhost_blk".to_string()) .spawn(move || { - if let Err(e) = handler.run(paused, paused_sync) { + if let Err(e) = SeccompFilter::apply(virtio_vhost_blk_seccomp_filter) { + error!("Error applying seccomp filter: {:?}", e); + } else if let Err(e) = handler.run(paused, paused_sync) { error!("Error running worker: {:?}", e); } }) diff --git a/vmm/src/device_manager.rs b/vmm/src/device_manager.rs index 2e9c06274..e507a90c5 100644 --- a/vmm/src/device_manager.rs +++ b/vmm/src/device_manager.rs @@ -1642,8 +1642,12 @@ impl DeviceManager { queue_size: disk_cfg.queue_size, }; let vhost_user_block_device = Arc::new(Mutex::new( - virtio_devices::vhost_user::Blk::new(id.clone(), vu_cfg) - .map_err(DeviceManagerError::CreateVhostUserBlk)?, + virtio_devices::vhost_user::Blk::new( + id.clone(), + vu_cfg, + self.seccomp_action.clone(), + ) + .map_err(DeviceManagerError::CreateVhostUserBlk)?, )); // Fill the device tree with a new node. In case of restore, we