kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

virtio-devices, vmm: Add seccomp rules for iommufd and vfio cdev

Browse Source 
Signed-off-by: Bo Chen <bchen@crusoe.ai>
This commit is contained in:
Bo Chen
2025-09-05 18:59:03 +00:00
parent fe5f991c37
commit 32c459c3dc
2 changed files with 62 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files

8
virtio-devices/src/seccomp_filters.rs
View File

@@ -53,6 +53,10 @@ macro_rules! or {
const VFIO_IOMMU_MAP_DMA: u64 = 0x3b71;
const VFIO_IOMMU_UNMAP_DMA: u64 = 0x3b72;
// See include/uapi/linux/iommufd.h in the kernel code.
const IOMMU_IOAS_MAP: u64 = 0x3b85;
const IOMMU_IOAS_UNMAP: u64 = 0x3b86;
#[cfg(feature = "sev_snp")]
fn mshv_sev_snp_ioctl_seccomp_rule() -> SeccompRule {
and![
@@ -83,6 +87,8 @@ fn create_virtio_iommu_ioctl_seccomp_rule() -> Vec<SeccompRule> {
or![
and![Cond::new(1, ArgLen::Dword, Eq, VFIO_IOMMU_MAP_DMA).unwrap()],
and![Cond::new(1, ArgLen::Dword, Eq, VFIO_IOMMU_UNMAP_DMA).unwrap()],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP).unwrap()],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP).unwrap()],
]
}
@@ -90,6 +96,8 @@ fn create_virtio_mem_ioctl_seccomp_rule() -> Vec<SeccompRule> {
or![
and![Cond::new(1, ArgLen::Dword, Eq, VFIO_IOMMU_MAP_DMA).unwrap()],
and![Cond::new(1, ArgLen::Dword, Eq, VFIO_IOMMU_UNMAP_DMA).unwrap()],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP).unwrap()],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP).unwrap()],
]
}

56
vmm/src/seccomp_filters.rs
View File

@@ -110,6 +110,18 @@ mod kvm {
pub const KVM_SET_NESTED_STATE: u64 = 1082175167;
}
mod iommufd {
// See include/uapi/linux/iommufd.h in the kernel code.
pub const IOMMU_IOAS_ALLOC: u64 = 0x3b81;
pub const IOMMU_IOAS_MAP: u64 = 0x3b85;
pub const IOMMU_IOAS_UNMAP: u64 = 0x3b86;
// See include/uapi/linux/vfio.h in the kernel code.
pub const VFIO_DEVICE_BIND_IOMMUFD: u64 = 0x3b76;
pub const VFIO_DEVICE_ATTACH_IOMMUFD_PT: u64 = 0x3b77;
pub const VFIO_DEVICE_DETACH_IOMMUFD_PT: u64 = 0x3b78;
}
// Block device ioctls (not exported by libc)
const BLKDISCARD: u64 = 0x1277; // _IO(0x12, 119)
const BLKZEROOUT: u64 = 0x127f; // _IO(0x12, 127)
@@ -247,6 +259,28 @@ fn create_vmm_ioctl_seccomp_rule_common_kvm() -> Result<Vec<SeccompRule>, Backen
])
}
fn create_vmm_ioctl_seccomp_rule_iommufd() -> Result<Vec<SeccompRule>, BackendError> {
use iommufd::*;
Ok(or![
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_ALLOC)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP)?],
and![Cond::new(1, ArgLen::Dword, Eq, VFIO_DEVICE_BIND_IOMMUFD)?],
and![Cond::new(
1,
ArgLen::Dword,
Eq,
VFIO_DEVICE_ATTACH_IOMMUFD_PT
)?],
and![Cond::new(
1,
ArgLen::Dword,
Eq,
VFIO_DEVICE_DETACH_IOMMUFD_PT
)?],
])
}
fn create_vmm_ioctl_seccomp_rule_hypervisor(
hypervisor_type: HypervisorType,
) -> Result<Vec<SeccompRule>, BackendError> {
@@ -373,9 +407,11 @@ fn create_vmm_ioctl_seccomp_rule_common(
];
let hypervisor_rules = create_vmm_ioctl_seccomp_rule_hypervisor(hypervisor_type)?;
common_rules.extend(hypervisor_rules);
let iommufd_rules = create_vmm_ioctl_seccomp_rule_iommufd()?;
common_rules.extend(iommufd_rules);
Ok(common_rules)
}
@@ -764,6 +800,20 @@ fn create_vcpu_ioctl_seccomp_rule_hypervisor(
}
}
fn create_vcpu_ioctl_seccomp_rule_iommufd() -> Result<Vec<SeccompRule>, BackendError> {
use iommufd::*;
Ok(or![
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_MAP)?],
and![Cond::new(1, ArgLen::Dword, Eq, IOMMU_IOAS_UNMAP)?],
and![Cond::new(
1,
ArgLen::Dword,
Eq,
VFIO_DEVICE_DETACH_IOMMUFD_PT
)?],
])
}
fn create_vcpu_ioctl_seccomp_rule(
hypervisor_type: HypervisorType,
) -> Result<Vec<SeccompRule>, BackendError> {
@@ -784,9 +834,11 @@ fn create_vcpu_ioctl_seccomp_rule(
];
let hypervisor_rules = create_vcpu_ioctl_seccomp_rule_hypervisor(hypervisor_type)?;
rules.extend(hypervisor_rules);
let iommufd_rules = create_vcpu_ioctl_seccomp_rule_iommufd()?;
rules.extend(iommufd_rules);
Ok(rules)
}