qemu: enable sandbox whitelist by default

[libvirt] [PATCHv2 3/4] Refactor qemuBuildSeccompSandboxCommandLine

Posted by Ján Tomko 7 years, 8 months ago

Exit early if possible to simplify the logic.

Signed-off-by: Ján Tomko <jtomko@redhat.com>
---
 src/qemu/qemu_command.c | 18 ++++++++++++------
 1 file changed, 12 insertions(+), 6 deletions(-)

diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
index dfeba54ee..ba279e640 100644
--- a/src/qemu/qemu_command.c
+++ b/src/qemu/qemu_command.c
@@ -9974,16 +9974,22 @@ qemuBuildSeccompSandboxCommandLine(virCommandPtr cmd,
                                    virQEMUDriverConfigPtr cfg,
                                    virQEMUCapsPtr qemuCaps)
 {
-    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX)) {
-        if (cfg->seccompSandbox == 0)
-            virCommandAddArgList(cmd, "-sandbox", "off", NULL);
-        else if (cfg->seccompSandbox > 0)
-            virCommandAddArgList(cmd, "-sandbox", "on", NULL);
-    } else if (cfg->seccompSandbox > 0) {
+    if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX) &&
+        cfg->seccompSandbox > 0) {
         virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
                        _("QEMU does not support seccomp sandboxes"));
         return -1;
     }
+
+    if (cfg->seccompSandbox == 0) {
+        if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX))
+            virCommandAddArgList(cmd, "-sandbox", "off", NULL);
+        return 0;
+    }
+
+    if (cfg->seccompSandbox > 0)
+        virCommandAddArgList(cmd, "-sandbox", "on", NULL);
+
     return 0;
 
 }
-- 
2.16.1

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCHv2 3/4] Refactor qemuBuildSeccompSandboxCommandLine

Posted by John Ferlan 7 years, 8 months ago


On 04/10/2018 10:49 AM, Ján Tomko wrote:
> Exit early if possible to simplify the logic.
> 
> Signed-off-by: Ján Tomko <jtomko@redhat.com>
> ---
>  src/qemu/qemu_command.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)
> 

Reviewed-by: John Ferlan <jferlan@redhat.com>

John

> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
> index dfeba54ee..ba279e640 100644
> --- a/src/qemu/qemu_command.c
> +++ b/src/qemu/qemu_command.c
> @@ -9974,16 +9974,22 @@ qemuBuildSeccompSandboxCommandLine(virCommandPtr cmd,
>                                     virQEMUDriverConfigPtr cfg,
>                                     virQEMUCapsPtr qemuCaps)
>  {

Could also use

   bool has_seccomp_cap = virQEMUCapsGet(qemuCaps,
QEMU_CAPS_SECCOMP_SANDBOX);

??

Then use - doesn't matter probably because the compiler will fix it.


> -    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX)) {
> -        if (cfg->seccompSandbox == 0)
> -            virCommandAddArgList(cmd, "-sandbox", "off", NULL);
> -        else if (cfg->seccompSandbox > 0)
> -            virCommandAddArgList(cmd, "-sandbox", "on", NULL);
> -    } else if (cfg->seccompSandbox > 0) {
> +    if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX) &&
> +        cfg->seccompSandbox > 0) {
>          virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
>                         _("QEMU does not support seccomp sandboxes"));
>          return -1;
>      }
> +
> +    if (cfg->seccompSandbox == 0) {
> +        if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX))
> +            virCommandAddArgList(cmd, "-sandbox", "off", NULL);
> +        return 0;
> +    }
> +
> +    if (cfg->seccompSandbox > 0)
> +        virCommandAddArgList(cmd, "-sandbox", "on", NULL);
> +
>      return 0;
>  
>  }
> 

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list

Re: [libvirt] [PATCHv2 3/4] Refactor qemuBuildSeccompSandboxCommandLine

Posted by Daniel P. Berrangé 7 years, 8 months ago

On Tue, Apr 10, 2018 at 04:49:41PM +0200, Ján Tomko wrote:
> Exit early if possible to simplify the logic.
> 
> Signed-off-by: Ján Tomko <jtomko@redhat.com>
> ---
>  src/qemu/qemu_command.c | 18 ++++++++++++------
>  1 file changed, 12 insertions(+), 6 deletions(-)

Reviewed-by: Daniel P. Berrangé <berrange@redhat.com>


> 
> diff --git a/src/qemu/qemu_command.c b/src/qemu/qemu_command.c
> index dfeba54ee..ba279e640 100644
> --- a/src/qemu/qemu_command.c
> +++ b/src/qemu/qemu_command.c
> @@ -9974,16 +9974,22 @@ qemuBuildSeccompSandboxCommandLine(virCommandPtr cmd,
>                                     virQEMUDriverConfigPtr cfg,
>                                     virQEMUCapsPtr qemuCaps)
>  {
> -    if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX)) {
> -        if (cfg->seccompSandbox == 0)
> -            virCommandAddArgList(cmd, "-sandbox", "off", NULL);
> -        else if (cfg->seccompSandbox > 0)
> -            virCommandAddArgList(cmd, "-sandbox", "on", NULL);
> -    } else if (cfg->seccompSandbox > 0) {
> +    if (!virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX) &&
> +        cfg->seccompSandbox > 0) {
>          virReportError(VIR_ERR_CONFIG_UNSUPPORTED, "%s",
>                         _("QEMU does not support seccomp sandboxes"));
>          return -1;
>      }
> +
> +    if (cfg->seccompSandbox == 0) {
> +        if (virQEMUCapsGet(qemuCaps, QEMU_CAPS_SECCOMP_SANDBOX))
> +            virCommandAddArgList(cmd, "-sandbox", "off", NULL);
> +        return 0;
> +    }
> +
> +    if (cfg->seccompSandbox > 0)
> +        virCommandAddArgList(cmd, "-sandbox", "on", NULL);
> +
>      return 0;
>  
>  }
> -- 
> 2.16.1
> 
> --
> libvir-list mailing list
> libvir-list@redhat.com
> https://www.redhat.com/mailman/listinfo/libvir-list

Regards,
Daniel
-- 
|: https://berrange.com      -o-    https://www.flickr.com/photos/dberrange :|
|: https://libvirt.org         -o-            https://fstop138.berrange.com :|
|: https://entangle-photo.org    -o-    https://www.instagram.com/dberrange :|

--
libvir-list mailing list
libvir-list@redhat.com
https://www.redhat.com/mailman/listinfo/libvir-list