otubo/qemu — pull request #1 by otubo (2012-07-12 19:40:06+00:00)
Title: Sandboxing Qemu guests with Libseccomp

Hello all,

This patch is an effort to sandbox Qemu guests using Libseccomp[0]. The patches that follows are pretty simple and straightforward. I added the correct options and checks to the configure script and the basic calls to libseccomp in the main loop at vl.c. Details of each one are in the emails of the patch set.

This support limits the system call footprint of the entire QEMU process to a limited set of syscalls, those that we know QEMU uses. The idea is to limit the allowable syscalls, therefore limiting the impact that an attacked guest could have on the host system.

It's important to note that the libseccomp itself needs the seccomp mode 2 feature in the kernel, which is pretty close to get to the mainline since it's already been accepted to the linux-next branch[1].

v2: The code now is separated in the files qemu-seccomp.c and qemu-seccomp.h for a cleaner implementation. The development was tested with the 3.5-rc1 kernel.

v3: As we discussed in previous emails in this very mailing list, this feature is not supposed to replace existing security feature, but add another layer to the whole. The whitelist should contain all the syscalls QEMU needs, so its execution won't be affected, just safer. And as stated by Will Drewry's commit
message[1]: "Filter programs will be inherited across fork/clone and execve.",the same white list should be passed along from the father process to the child, then execve() shouldn't be a problem.

v4: Introducing TRAP mode on libseccomp support. Now you're able to configure libseccomp to use SCMP_ACT_TRAP when calling syscall_trap(). It will verbosely print a message to the stderr in the form "seccomp: illegal system call execution trapped: XXX" and terminate immediately after.

As always, comments are more than welcome.

Regards,

[0] - http://sourceforge.net/projects/libseccomp/
[1] - http://git.kernel.org/?p=linux/kernel/git/next/linux-next.git;a=commit;h=e2cfabdfd075648216f99c2c03821cf3f47c1727