vhost_user_fs: Add seccomp

Implement seccomp; we use one filter for all threads.
The syscall list comes from the C daemon with syscalls added
as I hit them.

The default behaviour is to kill the process, this normally gets
audit logged.

--seccomp none  disables seccomp
          log   Just logs violations but doesn't stop it
          trap  causes a signal to be be sent that can be trapped.

If you suspect you're hitting a seccomp action then you can
check the audit log;  you could also switch to running with 'log'
to collect a bunch of calls to report.
To see where the syscalls are coming from use 'trap' with a debugger
or coredump to backtrace it.

This can be improved for some syscalls to restrict the parameters
to some syscalls to make them more restrictive.

Signed-off-by: Dr. David Alan Gilbert <dgilbert@redhat.com>

src/bin/vhost_user_fs.rs

@@ -14,6 +14,7 @@ use epoll;
 use futures::executor::{ThreadPool, ThreadPoolBuilder};
 use libc::EFD_NONBLOCK;
 use log::*;
+use seccomp::SeccompAction;
 use std::num::Wrapping;
 use std::sync::{Arc, Mutex, RwLock};
 use std::{convert, error, fmt, io, process};
@@ -26,6 +27,7 @@ use vhost_user_fs::descriptor_utils::{Reader, Writer};
 use vhost_user_fs::filesystem::FileSystem;
 use vhost_user_fs::passthrough::{self, PassthroughFs};
 use vhost_user_fs::sandbox::Sandbox;
+use vhost_user_fs::seccomp::enable_seccomp;
 use vhost_user_fs::server::Server;
 use vhost_user_fs::Error as VhostUserFsError;
 use virtio_bindings::bindings::virtio_net::*;
@@ -316,6 +318,13 @@ fn main() {
                 .long("disable-sandbox")
                 .help("Don't set up a sandbox for the daemon"),
         )
+        .arg(
+            Arg::with_name("seccomp")
+                .long("seccomp")
+                .help("Disable/debug seccomp security")
+                .possible_values(&["kill", "log", "trap", "none"])
+                .default_value("kill"),
+        )
         .get_matches();
 
     // Retrieve arguments
@@ -331,6 +340,13 @@ fn main() {
     };
     let xattr: bool = !cmd_arguments.is_present("disable-xattr");
     let create_sandbox: bool = !cmd_arguments.is_present("disable-sandbox");
+    let seccomp_mode: SeccompAction = match cmd_arguments.value_of("seccomp").unwrap() {
+        "none" => SeccompAction::Allow, // i.e. no seccomp
+        "kill" => SeccompAction::Kill,
+        "log" => SeccompAction::Log,
+        "trap" => SeccompAction::Trap,
+        _ => unreachable!(), // We told Arg possible_values
+    };
 
     let listener = Listener::new(sock, true).unwrap();
 
@@ -356,6 +372,11 @@ fn main() {
         }
     };
 
+    // Must happen before we start the thread pool
+    if seccomp_mode != SeccompAction::Allow {
+        enable_seccomp(seccomp_mode).unwrap();
+    };
+
     let fs = PassthroughFs::new(fs_cfg).unwrap();
     let fs_backend = Arc::new(RwLock::new(
         VhostUserFsBackend::new(fs, thread_pool_size).unwrap(),