Re: [Virtio-fs] [PATCH] virtiofsd: Add `sigreturn` to the seccomp whitelist

From: Marc Hartmayer <mhartmay@linux.ibm.com>
To: German Maglione <gmaglione@redhat.com>
Cc: qemu-devel@nongnu.org, Stefan Liebler <stli@linux.ibm.com>,
	virtio-fs@redhat.com,
	Christian Borntraeger <borntraeger@de.ibm.com>,
	qemu-s390x <qemu-s390x@nongnu.org>,
	Sven Schnelle <svens@linux.ibm.com>,
	Stefan Hajnoczi <stefanha@redhat.com>
Subject: Re: [Virtio-fs] [PATCH] virtiofsd: Add `sigreturn` to the seccomp whitelist
Date: Thu, 01 Dec 2022 10:44:01 +0100	[thread overview]
Message-ID: <87y1rr31cu.fsf@linux.ibm.com> (raw)
In-Reply-To: <CAJh=p+6ZoUD7788GewpvAPq2mc=QDEA89B3QMMcAynTqs9szxQ@mail.gmail.com>

German Maglione <gmaglione@redhat.com> writes:

> On Mon, Nov 28, 2022 at 10:00 AM Marc Hartmayer <mhartmay@linux.ibm.com> wrote:
>>
>> German Maglione <gmaglione@redhat.com> writes:
>>
>> > On Fri, Nov 25, 2022 at 3:40 PM Marc Hartmayer <mhartmay@linux.ibm.com> wrote:
>> >>
>> >> The virtiofsd currently crashes on s390x. This is because of a
>> >> `sigreturn` system call. See audit log below:
>> >>
>> >> type=SECCOMP msg=audit(1669382477.611:459): auid=4294967295 uid=0 gid=0 ses=4294967295 subj=system_u:system_r:virtd_t:s0-s0:c0.c1023 pid=6649 comm="virtiofsd" exe="/usr/libexec/virtiofsd" sig=31 arch=80000016 syscall=119 compat=0 ip=0x3fff15f748a code=0x80000000AUID="unset" UID="root" GID="root" ARCH=s390x SYSCALL=sigreturn
>> >>
>> >> Signed-off-by: Marc Hartmayer <mhartmay@linux.ibm.com>
>> >> ---
>> >>  tools/virtiofsd/passthrough_seccomp.c | 1 +
>> >>  1 file changed, 1 insertion(+)
>> >>
>> >> diff --git a/tools/virtiofsd/passthrough_seccomp.c b/tools/virtiofsd/passthrough_seccomp.c
>> >> index 888295c073de..0033dab4939e 100644
>> >> --- a/tools/virtiofsd/passthrough_seccomp.c
>> >> +++ b/tools/virtiofsd/passthrough_seccomp.c
>> >> @@ -110,6 +110,7 @@ static const int syscall_allowlist[] = {
>> >>  #endif
>> >>      SCMP_SYS(set_robust_list),
>> >>      SCMP_SYS(setxattr),
>> >> +    SCMP_SYS(sigreturn),
>> >>      SCMP_SYS(symlinkat),
>> >>      SCMP_SYS(syncfs),
>> >>      SCMP_SYS(time), /* Rarely needed, except on static builds */
>> >> --
>> >> 2.34.1
>> >>
>> >> _______________________________________________
>> >> Virtio-fs mailing list
>> >> Virtio-fs@redhat.com
>> >> https://listman.redhat.com/mailman/listinfo/virtio-fs
>> >>
>> >
>> > Reviewed-by:  German Maglione <gmaglione@redhat.com>
>>
>> Thanks.
>>
>> >
>> > Should we add this also in the rust version?, I see we don't have it
>> > enabled either.
>>
>> Yep - thanks.
>
> Could you test this MR to see if it is ok?
> https://gitlab.com/virtio-fs/virtiofsd/-/merge_requests/144

I couldn’t reproduce the problem using the Rust version - even without
your patch. With your patch applied it’s (of course) still working.

>
> Thanks,
>
> -- 
> German
>
-- 
Kind regards / Beste Grüße
   Marc Hartmayer

IBM Deutschland Research & Development GmbH
Vorsitzender des Aufsichtsrats: Gregor Pillen 
Geschäftsführung: David Faller
Sitz der Gesellschaft: Böblingen
Registergericht: Amtsgericht Stuttgart, HRB 243294