diff --git a/src/main.rs b/src/main.rs index f920fcf07..b86334093 100644 --- a/src/main.rs +++ b/src/main.rs @@ -12,7 +12,7 @@ extern crate clap; use clap::{App, Arg, ArgGroup, ArgMatches}; use libc::EFD_NONBLOCK; use log::LevelFilter; -use seccomp::SeccompLevel; +use seccomp::SeccompAction; use std::sync::mpsc::channel; use std::sync::{Arc, Mutex}; use std::{env, process}; @@ -288,18 +288,17 @@ fn start_vmm(cmd_arguments: ArgMatches) { let api_evt = EventFd::new(EFD_NONBLOCK).expect("Cannot create API EventFd"); let http_sender = api_request_sender.clone(); - - let seccomp_level = if let Some(seccomp_value) = cmd_arguments.value_of("seccomp") { + let seccomp_action = if let Some(seccomp_value) = cmd_arguments.value_of("seccomp") { match seccomp_value { - "true" => SeccompLevel::Advanced, - "false" => SeccompLevel::None, + "true" => SeccompAction::Trap, + "false" => SeccompAction::Allow, _ => { eprintln!("Invalid parameter {} for \"--seccomp\" flag", seccomp_value); process::exit(1); } } } else { - SeccompLevel::Advanced + SeccompAction::Trap }; let hypervisor = hypervisor::new().unwrap(); let vmm_thread = match vmm::start_vmm_thread( @@ -308,7 +307,7 @@ fn start_vmm(cmd_arguments: ArgMatches) { api_evt.try_clone().unwrap(), http_sender, api_request_receiver, - &seccomp_level, + &seccomp_action, hypervisor, ) { Ok(t) => t, diff --git a/vmm/src/api/http.rs b/vmm/src/api/http.rs index 85674e41f..a01aa3bbf 100644 --- a/vmm/src/api/http.rs +++ b/vmm/src/api/http.rs @@ -8,7 +8,7 @@ use crate::api::{ApiError, ApiRequest, VmAction}; use crate::seccomp_filters::{get_seccomp_filter, Thread}; use crate::{Error, Result}; use micro_http::{Body, HttpServer, MediaType, Method, Request, Response, StatusCode, Version}; -use seccomp::{SeccompFilter, SeccompLevel}; +use seccomp::{SeccompAction, SeccompFilter}; use serde_json::Error as SerdeError; use std::collections::HashMap; use std::path::PathBuf; @@ -241,14 +241,14 @@ pub fn start_http_thread( path: &str, api_notifier: EventFd, api_sender: Sender, - seccomp_level: &SeccompLevel, + seccomp_action: &SeccompAction, ) -> Result>> { std::fs::remove_file(path).unwrap_or_default(); let socket_path = PathBuf::from(path); // Retrieve seccomp filter for API thread let api_seccomp_filter = - get_seccomp_filter(seccomp_level, Thread::Api).map_err(Error::CreateSeccompFilter)?; + get_seccomp_filter(seccomp_action, Thread::Api).map_err(Error::CreateSeccompFilter)?; thread::Builder::new() .name("http-server".to_string()) diff --git a/vmm/src/lib.rs b/vmm/src/lib.rs index 1dfdf300c..4f3a41494 100644 --- a/vmm/src/lib.rs +++ b/vmm/src/lib.rs @@ -30,7 +30,7 @@ use crate::migration::{get_vm_snapshot, recv_vm_snapshot}; use crate::seccomp_filters::{get_seccomp_filter, Thread}; use crate::vm::{Error as VmError, Vm, VmState}; use libc::EFD_NONBLOCK; -use seccomp::{SeccompFilter, SeccompLevel}; +use seccomp::{SeccompAction, SeccompFilter}; use serde::ser::{Serialize, SerializeStruct, Serializer}; use std::fs::File; use std::io; @@ -214,14 +214,14 @@ pub fn start_vmm_thread( api_event: EventFd, api_sender: Sender, api_receiver: Receiver, - seccomp_level: &SeccompLevel, + seccomp_action: &SeccompAction, hypervisor: Arc, ) -> Result>> { let http_api_event = api_event.try_clone().map_err(Error::EventFdClone)?; // Retrieve seccomp filter let vmm_seccomp_filter = - get_seccomp_filter(seccomp_level, Thread::Vmm).map_err(Error::CreateSeccompFilter)?; + get_seccomp_filter(seccomp_action, Thread::Vmm).map_err(Error::CreateSeccompFilter)?; // Find the path that the "/proc//exe" symlink points to. Must be done before spawning // a thread as Rust does not put the child threads in the same thread group which prevents the @@ -242,7 +242,7 @@ pub fn start_vmm_thread( .map_err(Error::VmmThreadSpawn)?; // The VMM thread is started, we can start serving HTTP requests - api::start_http_thread(http_path, http_api_event, api_sender, seccomp_level)?; + api::start_http_thread(http_path, http_api_event, api_sender, seccomp_action)?; Ok(thread) } diff --git a/vmm/src/seccomp_filters.rs b/vmm/src/seccomp_filters.rs index 25b979044..ea4c089a5 100644 --- a/vmm/src/seccomp_filters.rs +++ b/vmm/src/seccomp_filters.rs @@ -6,8 +6,7 @@ use seccomp::{ allow_syscall, allow_syscall_if, BpfProgram, Error, SeccompAction, SeccompCmpArgLen as ArgLen, - SeccompCmpOp::Eq, SeccompCondition as Cond, SeccompError, SeccompFilter, SeccompLevel, - SeccompRule, + SeccompCmpOp::Eq, SeccompCondition as Cond, SeccompError, SeccompFilter, SeccompRule, }; use std::convert::TryInto; @@ -381,17 +380,17 @@ pub fn api_thread_filter() -> Result { )?) } -/// Generate a BPF program based on a seccomp level value. +/// Generate a BPF program based on the seccomp_action value pub fn get_seccomp_filter( - seccomp_level: &SeccompLevel, + seccomp_action: &SeccompAction, thread_type: Thread, ) -> Result { let filter = match thread_type { Thread::Vmm => vmm_thread_filter(), Thread::Api => api_thread_filter(), }; - match *seccomp_level { - SeccompLevel::None => Ok(vec![]), + match seccomp_action { + SeccompAction::Allow => Ok(vec![]), _ => filter .and_then(|filter| filter.try_into()) .map_err(SeccompError::SeccompFilter),