From 463805711056b431a74917a75cda75ec67fec3d2 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Daniel=20P=2E=20Berrang=C3=A9?= Date: Thu, 29 Apr 2021 11:25:13 +0100 Subject: seccomp: block setns, unshare and execveat syscalls MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit setns/unshare are used to change namespaces which is not something QEMU needs to be able todo. execveat is a new variant of execve so should be blocked just like execve already is. Acked-by: Eduardo Otubo Signed-off-by: Daniel P. Berrangé --- softmmu/qemu-seccomp.c | 5 +++++ 1 file changed, 5 insertions(+) (limited to 'softmmu/qemu-seccomp.c') diff --git a/softmmu/qemu-seccomp.c b/softmmu/qemu-seccomp.c index a7bb5c350f..deaf8a4ef5 100644 --- a/softmmu/qemu-seccomp.c +++ b/softmmu/qemu-seccomp.c @@ -248,6 +248,11 @@ static const struct QemuSeccompSyscall denylist[] = { { SCMP_SYS(clone3), QEMU_SECCOMP_SET_SPAWN, 0, NULL, SCMP_ACT_ERRNO(ENOSYS) }, #endif +#ifdef __SNR_execveat + { SCMP_SYS(execveat), QEMU_SECCOMP_SET_SPAWN }, +#endif + { SCMP_SYS(setns), QEMU_SECCOMP_SET_SPAWN }, + { SCMP_SYS(unshare), QEMU_SECCOMP_SET_SPAWN }, /* resource control */ { SCMP_SYS(setpriority), QEMU_SECCOMP_SET_RESOURCECTL, 0, NULL, SCMP_ACT_ERRNO(EPERM) }, -- cgit v1.2.3