72f4642d7c
- Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.0 * Patches added: 0042-seccomp-prefer-SCMP_ACT_KILL_PROCES.patch 0043-configure-require-libseccomp-2.2.0.patch 0044-seccomp-set-the-seccomp-filter-to-a.patch 0045-sandbox-disable-sandbox-if-CONFIG_S.patch 0046-seccomp-check-TSYNC-host-capability.patch * Adding changes to mitigate seccomp vulnerability (CVE-2018-15746 bsc#1106222) - Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.0 * Patches added: 0042-seccomp-prefer-SCMP_ACT_KILL_PROCES.patch 0043-configure-require-libseccomp-2.2.0.patch 0044-seccomp-set-the-seccomp-filter-to-a.patch 0045-sandbox-disable-sandbox-if-CONFIG_S.patch 0046-seccomp-check-TSYNC-host-capability.patch * Adding changes to mitigate seccomp vulnerability (CVE-2018-15746 bsc#1106222) - Patch queue updated from git://github.com/openSUSE/qemu.git opensuse-3.0 * Patches added: 0042-seccomp-prefer-SCMP_ACT_KILL_PROCES.patch 0043-configure-require-libseccomp-2.2.0.patch 0044-seccomp-set-the-seccomp-filter-to-a.patch 0045-sandbox-disable-sandbox-if-CONFIG_S.patch 0046-seccomp-check-TSYNC-host-capability.patch OBS-URL: https://build.opensuse.org/request/show/640126 OBS-URL: https://build.opensuse.org/package/show/Virtualization/qemu?expand=0&rev=431
69 lines
2.1 KiB
Diff
69 lines
2.1 KiB
Diff
From 79883c93023ec6d7b55cf2a3e91afcfda44e3a61 Mon Sep 17 00:00:00 2001
|
|
From: =?UTF-8?q?Marc-Andr=C3=A9=20Lureau?= <marcandre.lureau@redhat.com>
|
|
Date: Thu, 30 Aug 2018 16:33:48 +0200
|
|
Subject: [PATCH] seccomp: check TSYNC host capability
|
|
MIME-Version: 1.0
|
|
Content-Type: text/plain; charset=UTF-8
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
Remove -sandbox option if the host is not capable of TSYNC, since the
|
|
sandbox will fail at setup time otherwise. This will help libvirt, for
|
|
ex, to figure out if -sandbox will work.
|
|
|
|
Signed-off-by: Marc-André Lureau <marcandre.lureau@redhat.com>
|
|
Signed-off-by: Eduardo Otubo <otubo@redhat.com>
|
|
Acked-by: Eduardo Otubo <otubo@redhat.com>
|
|
(cherry picked from commit 5780760f5ea6163939a5dabe7427318b4f07d1a2)
|
|
[LD: BSC#1106222 CVE-2018-15746]
|
|
Signed-off-by: Larry Dewey <ldewey@suse.com>
|
|
---
|
|
qemu-seccomp.c | 19 ++++++++++++++++++-
|
|
vl.c | 4 ++--
|
|
2 files changed, 20 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/qemu-seccomp.c b/qemu-seccomp.c
|
|
index 5507d9c4ef..1d94bdaf55 100644
|
|
--- a/qemu-seccomp.c
|
|
+++ b/qemu-seccomp.c
|
|
@@ -281,7 +281,24 @@ static QemuOptsList qemu_sandbox_opts = {
|
|
|
|
static void seccomp_register(void)
|
|
{
|
|
- qemu_add_opts(&qemu_sandbox_opts);
|
|
+ bool add = false;
|
|
+
|
|
+ /* FIXME: use seccomp_api_get() >= 2 check when released */
|
|
+
|
|
+#if defined(SECCOMP_FILTER_FLAG_TSYNC)
|
|
+ int check;
|
|
+
|
|
+ /* check host TSYNC capability, it returns errno == ENOSYS if unavailable */
|
|
+ check = qemu_seccomp(SECCOMP_SET_MODE_FILTER,
|
|
+ SECCOMP_FILTER_FLAG_TSYNC, NULL);
|
|
+ if (check < 0 && errno == EFAULT) {
|
|
+ add = true;
|
|
+ }
|
|
+#endif
|
|
+
|
|
+ if (add) {
|
|
+ qemu_add_opts(&qemu_sandbox_opts);
|
|
+ }
|
|
}
|
|
opts_init(seccomp_register);
|
|
#endif
|
|
diff --git a/vl.c b/vl.c
|
|
index 3af5bcdc9e..a0295abb3e 100644
|
|
--- a/vl.c
|
|
+++ b/vl.c
|
|
@@ -4015,8 +4015,8 @@ int main(int argc, char **argv, char **envp)
|
|
}
|
|
|
|
#ifdef CONFIG_SECCOMP
|
|
- if (qemu_opts_foreach(qemu_find_opts("sandbox"),
|
|
- parse_sandbox, NULL, NULL)) {
|
|
+ olist = qemu_find_opts_err("sandbox", NULL);
|
|
+ if (olist && qemu_opts_foreach(olist, parse_sandbox, NULL, NULL)) {
|
|
exit(1);
|
|
}
|
|
#endif
|