kata-containers/cloud-hypervisor
1
0
Fork 0
mirror of https://github.com/cloud-hypervisor/cloud-hypervisor.git synced 2026-08-05 02:19:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

vmm: dbus: apply seccomp filter

Browse Source 
This commit applies the previously created seccomp filter
to the `DbusApi` thread.

Also encloses the main loop of the `DBusApi` thread using
`std::panic::catch_unwind` and `AssertUnwindSafe` in order to mirror
the behavior of the HTTP API.

Signed-off-by: Omer Faruk Bayram <omer.faruk@sartura.hr>
This commit is contained in:
Omer Faruk Bayram
2023-05-20 12:43:39 +03:00
committed by Bo Chen
parent 0664647109
commit a92d852848
1 changed files with 44 additions and 18 deletions
Download Patch File Download Diff File Expand all files Collapse all files

62
vmm/src/api/dbus/mod.rs
View File

@@ -3,11 +3,13 @@
// SPDX-License-Identifier: Apache-2.0 // SPDX-License-Identifier: Apache-2.0
// //
use super::{ApiRequest, VmAction}; use super::{ApiRequest, VmAction};
use crate::seccomp_filters::{get_seccomp_filter, Thread};
use crate::{Error as VmmError, Result as VmmResult}; use crate::{Error as VmmError, Result as VmmResult};
use futures::channel::oneshot; use futures::channel::oneshot;
use futures::{executor, FutureExt}; use futures::{executor, FutureExt};
use hypervisor::HypervisorType; use hypervisor::HypervisorType;
use seccompiler::SeccompAction; use seccompiler::{apply_filter, SeccompAction};
use std::panic::AssertUnwindSafe;
use std::sync::mpsc::Sender; use std::sync::mpsc::Sender;
use std::sync::{Arc, Mutex}; use std::sync::{Arc, Mutex};
use std::thread; use std::thread;
@@ -280,10 +282,10 @@ impl DBusApi {
pub fn start_dbus_thread( pub fn start_dbus_thread(
api_notifier: EventFd, api_notifier: EventFd,
api_sender: Sender<ApiRequest>, api_sender: Sender<ApiRequest>,
_seccomp_action: &SeccompAction, seccomp_action: &SeccompAction,
_exit_evt: EventFd, exit_evt: EventFd,
_hypervisor_type: HypervisorType, hypervisor_type: HypervisorType,
) -> VmmResult<(thread::JoinHandle<()>, DBusApiShutdownChannels)> { ) -> VmmResult<(thread::JoinHandle<VmmResult<()>>, DBusApiShutdownChannels)> {
let dbus_iface = DBusApi::new(api_notifier, api_sender); let dbus_iface = DBusApi::new(api_notifier, api_sender);
let connection = executor::block_on(async move { let connection = executor::block_on(async move {
ConnectionBuilder::session()? ConnectionBuilder::session()?
@@ -298,25 +300,49 @@ pub fn start_dbus_thread(
let (send_shutdown, recv_shutdown) = oneshot::channel::<()>(); let (send_shutdown, recv_shutdown) = oneshot::channel::<()>();
let (send_done, recv_done) = oneshot::channel::<()>(); let (send_done, recv_done) = oneshot::channel::<()>();
// Retrieve seccomp filter for API thread
let api_seccomp_filter = get_seccomp_filter(seccomp_action, Thread::DBusApi, hypervisor_type)
.map_err(VmmError::CreateSeccompFilter)?;
let thread_join_handle = thread::Builder::new() let thread_join_handle = thread::Builder::new()
.name("dbus-thread".to_string()) .name("dbus-thread".to_string())
.spawn(move || { .spawn(move || {
executor::block_on(async move { // Apply seccomp filter for API thread.
let recv_shutdown = recv_shutdown.fuse(); if !api_seccomp_filter.is_empty() {
let executor_tick = futures::future::Fuse::terminated(); apply_filter(&api_seccomp_filter)
futures::pin_mut!(recv_shutdown, executor_tick); .map_err(VmmError::ApplySeccompFilter)
executor_tick.set(connection.executor().tick().fuse()); .map_err(|e| {
error!("Error applying seccomp filter: {:?}", e);
exit_evt.write(1).ok();
e
})?;
}
loop { std::panic::catch_unwind(AssertUnwindSafe(move || {
futures::select! { executor::block_on(async move {
_ = executor_tick => executor_tick.set(connection.executor().tick().fuse()), let recv_shutdown = recv_shutdown.fuse();
_ = recv_shutdown => { let executor_tick = futures::future::Fuse::terminated();
send_done.send(()).ok(); futures::pin_mut!(recv_shutdown, executor_tick);
break; executor_tick.set(connection.executor().tick().fuse());
},
loop {
futures::select! {
_ = executor_tick => executor_tick.set(connection.executor().tick().fuse()),
_ = recv_shutdown => {
send_done.send(()).ok();
break;
},
}
} }
} })
}))
.map_err(|_| {
error!("dbus-api thread panicked");
exit_evt.write(1).ok()
}) })
.ok();
Ok(())
}) })
.map_err(VmmError::DBusThreadSpawn)?; .map_err(VmmError::DBusThreadSpawn)?;