diff mbox

Whitelist sysinfo call

Message ID 1457343286-16019-1-git-send-email-mrezanin@redhat.com (mailing list archive)
State New, archived
Headers show

Commit Message

Miroslav Rezanina March 7, 2016, 9:34 a.m. UTC
From: Miroslav Rezanina <mrezanin@redhat.com>

Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
so qemu using rbd image hang after start when run in sandbox mode.

To allow using rbd images in sandbox mode we have to whitelist it.

Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
---
 qemu-seccomp.c | 1 +
 1 file changed, 1 insertion(+)

Comments

Eduardo Otubo March 11, 2016, 8:51 a.m. UTC | #1
On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote:
> From: Miroslav Rezanina <mrezanin@redhat.com>
> 
> Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> so qemu using rbd image hang after start when run in sandbox mode.
> 
> To allow using rbd images in sandbox mode we have to whitelist it.
> 
> Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> ---
>  qemu-seccomp.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 2866e3c..e29fca1 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>  #ifdef HAVE_CACHEFLUSH
>      { SCMP_SYS(cacheflush), 240 },
>  #endif
> +    { SCMP_SYS(sysinfo), 240 },

Are you sure you want to add this syscall to the bottom of the list? Did
you estimate the frequency it is called by running strace?

Thanks for the patch.
Miroslav Rezanina March 21, 2016, 12:17 p.m. UTC | #2
----- ??????? -----
> ???: "Eduardo Otubo" <eduardo.otubo@profitbricks.com>
> ??: mrezanin@redhat.com
> Cc: qemu-devel@nongnu.org, armbru@redhat.com
> ????: 2016?3?11?, ??? ?? 9:51:50
> ??: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> 
> On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote:
> > From: Miroslav Rezanina <mrezanin@redhat.com>
> > 
> > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > so qemu using rbd image hang after start when run in sandbox mode.
> > 
> > To allow using rbd images in sandbox mode we have to whitelist it.
> > 
> > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> > ---
> >  qemu-seccomp.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 2866e3c..e29fca1 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > seccomp_whitelist[] = {
> >  #ifdef HAVE_CACHEFLUSH
> >      { SCMP_SYS(cacheflush), 240 },
> >  #endif
> > +    { SCMP_SYS(sysinfo), 240 },
> 
> Are you sure you want to add this syscall to the bottom of the list? Did
> you estimate the frequency it is called by running strace?
> 
> Thanks for the patch.
> 
Hi,

Yes, it wasn't used before nss update and now is used only for rbd based images
where it is called just few times upon start so drawback should be minimal. With
this we do not change cost of other calls.

Thanks for review and question,
Mirek

> --
> Eduardo Otubo
> ProfitBricks GmbH
>
Eduardo Otubo April 1, 2016, 8:47 a.m. UTC | #3
On Mon, Mar 21, 2016 at 08=17=45AM -0400, Miroslav Rezanina wrote:
> 
> 
> ----- ??????? -----
> > ???: "Eduardo Otubo" <eduardo.otubo@profitbricks.com>
> > ??: mrezanin@redhat.com
> > Cc: qemu-devel@nongnu.org, armbru@redhat.com
> > ????: 2016?3?11?, ??? ?? 9:51:50
> > ??: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> > 
> > On Mon, Mar 07, 2016 at 10=34=46AM +0100, mrezanin@redhat.com wrote:
> > > From: Miroslav Rezanina <mrezanin@redhat.com>
> > > 
> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > > so qemu using rbd image hang after start when run in sandbox mode.
> > > 
> > > To allow using rbd images in sandbox mode we have to whitelist it.
> > > 
> > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> > > ---
> > >  qemu-seccomp.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > > index 2866e3c..e29fca1 100644
> > > --- a/qemu-seccomp.c
> > > +++ b/qemu-seccomp.c
> > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > > seccomp_whitelist[] = {
> > >  #ifdef HAVE_CACHEFLUSH
> > >      { SCMP_SYS(cacheflush), 240 },
> > >  #endif
> > > +    { SCMP_SYS(sysinfo), 240 },
> > 
> > Are you sure you want to add this syscall to the bottom of the list? Did
> > you estimate the frequency it is called by running strace?
> > 
> > Thanks for the patch.
> > 
> Hi,
> 
> Yes, it wasn't used before nss update and now is used only for rbd based images
> where it is called just few times upon start so drawback should be minimal. With
> this we do not change cost of other calls.
> 
> Thanks for review and question,
> Mirek

Ok. So, ACK on this patch. I'll roll out a pull request by the end of
the day.
Thanks for the contribution.
Serge E. Hallyn April 11, 2016, 8:19 p.m. UTC | #4
Quoting mrezanin@redhat.com (mrezanin@redhat.com):
> From: Miroslav Rezanina <mrezanin@redhat.com>
> 
> Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> so qemu using rbd image hang after start when run in sandbox mode.
> 
> To allow using rbd images in sandbox mode we have to whitelist it.
> 
> Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>

Thanks.

Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

> ---
>  qemu-seccomp.c | 1 +
>  1 file changed, 1 insertion(+)
> 
> diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> index 2866e3c..e29fca1 100644
> --- a/qemu-seccomp.c
> +++ b/qemu-seccomp.c
> @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
>  #ifdef HAVE_CACHEFLUSH
>      { SCMP_SYS(cacheflush), 240 },
>  #endif
> +    { SCMP_SYS(sysinfo), 240 },
>  };
>  
>  int seccomp_start(void)
> -- 
> 2.5.0
> 
>
Eduardo Otubo April 12, 2016, 11:53 a.m. UTC | #5
On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote:
> Quoting mrezanin@redhat.com (mrezanin@redhat.com):
> > From: Miroslav Rezanina <mrezanin@redhat.com>
> > 
> > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > so qemu using rbd image hang after start when run in sandbox mode.
> > 
> > To allow using rbd images in sandbox mode we have to whitelist it.
> > 
> > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> 
> Thanks.
> 
> Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>

Also: I'll change the subject of this email a little bit for a cleaner
and more explicit commit.

Thanks.

> 
> > ---
> >  qemu-seccomp.c | 1 +
> >  1 file changed, 1 insertion(+)
> > 
> > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > index 2866e3c..e29fca1 100644
> > --- a/qemu-seccomp.c
> > +++ b/qemu-seccomp.c
> > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall seccomp_whitelist[] = {
> >  #ifdef HAVE_CACHEFLUSH
> >      { SCMP_SYS(cacheflush), 240 },
> >  #endif
> > +    { SCMP_SYS(sysinfo), 240 },
> >  };
> >  
> >  int seccomp_start(void)
> > -- 
> > 2.5.0
> > 
> > 
>
Miroslav Rezanina April 12, 2016, 12:03 p.m. UTC | #6
----- ??????? -----
> ???: "Eduardo Otubo" <eduardo.otubo@profitbricks.com>
> ??: "Serge Hallyn" <serge.hallyn@ubuntu.com>
> Cc: mrezanin@redhat.com, qemu-devel@nongnu.org, armbru@redhat.com
> ????: 2016?4?12?, ??? ?? 1:53:47
> ??: Re: Re: [Qemu-devel] [PATCH] Whitelist sysinfo call
> 
> On Mon, Apr 11, 2016 at 08=19=52PM +0000, Serge Hallyn wrote:
> > Quoting mrezanin@redhat.com (mrezanin@redhat.com):
> > > From: Miroslav Rezanina <mrezanin@redhat.com>
> > > 
> > > Newer version of nss-softokn libraries (> 3.16.2.3) use sysinfo call
> > > so qemu using rbd image hang after start when run in sandbox mode.
> > > 
> > > To allow using rbd images in sandbox mode we have to whitelist it.
> > > 
> > > Signed-off-by: Miroslav Rezanina <mrezanin@redhat.com>
> > 
> > Thanks.
> > 
> > Acked-by: Serge E. Hallyn <serge.hallyn@ubuntu.com>
> 
> Also: I'll change the subject of this email a little bit for a cleaner
> and more explicit commit.
> 
> Thanks.

Ok, thanks.

Mirek
> 
> > 
> > > ---
> > >  qemu-seccomp.c | 1 +
> > >  1 file changed, 1 insertion(+)
> > > 
> > > diff --git a/qemu-seccomp.c b/qemu-seccomp.c
> > > index 2866e3c..e29fca1 100644
> > > --- a/qemu-seccomp.c
> > > +++ b/qemu-seccomp.c
> > > @@ -250,6 +250,7 @@ static const struct QemuSeccompSyscall
> > > seccomp_whitelist[] = {
> > >  #ifdef HAVE_CACHEFLUSH
> > >      { SCMP_SYS(cacheflush), 240 },
> > >  #endif
> > > +    { SCMP_SYS(sysinfo), 240 },
> > >  };
> > >  
> > >  int seccomp_start(void)
> > > --
> > > 2.5.0
> > > 
> > > 
> > 
> 
> --
> Eduardo Otubo
> ProfitBricks GmbH
>
diff mbox

Patch

diff --git a/qemu-seccomp.c b/qemu-seccomp.c
index 2866e3c..e29fca1 100644
--- a/qemu-seccomp.c
+++ b/qemu-seccomp.c
@@ -250,6 +250,7 @@  static const struct QemuSeccompSyscall seccomp_whitelist[] = {
 #ifdef HAVE_CACHEFLUSH
     { SCMP_SYS(cacheflush), 240 },
 #endif
+    { SCMP_SYS(sysinfo), 240 },
 };
 
 int seccomp_start(void)