virtio-devices: seccomp: Add seccomp filters for pmem thread

This patch enables the seccomp filters for the pmem worker thread.

Partially fixes: #925

Signed-off-by: Bo Chen <chen.bo@intel.com>

virtio-devices/src/pmem.rs

@@ -12,9 +12,11 @@ use super::{
     EpollHelperHandler, Queue, UserspaceMapping, VirtioDevice, VirtioDeviceType,
     EPOLL_HELPER_EVENT_LAST, VIRTIO_F_IOMMU_PLATFORM, VIRTIO_F_VERSION_1,
 };
+use crate::seccomp_filters::{get_seccomp_filter, Thread};
 use crate::{VirtioInterrupt, VirtioInterruptType};
 use anyhow::anyhow;
 use libc::EFD_NONBLOCK;
+use seccomp::{SeccompAction, SeccompFilter};
 use serde::ser::{Serialize, SerializeStruct, Serializer};
 use std::fmt::{self, Display};
 use std::fs::File;
@@ -286,6 +288,7 @@ pub struct Pmem {
     epoll_threads: Option<Vec<thread::JoinHandle<result::Result<(), EpollHelperError>>>>,
     paused: Arc<AtomicBool>,
     mapping: UserspaceMapping,
+    seccomp_action: SeccompAction,
 
     // Hold ownership of the memory that is allocated for the device
     // which will be automatically dropped when the device is dropped
@@ -307,6 +310,7 @@ impl Pmem {
         mapping: UserspaceMapping,
         _region: MmapRegion,
         iommu: bool,
+        seccomp_action: SeccompAction,
     ) -> io::Result<Pmem> {
         let config = VirtioPmemConfig {
             start: addr.raw_value().to_le(),
@@ -332,6 +336,7 @@ impl Pmem {
             epoll_threads: None,
             paused: Arc::new(AtomicBool::new(false)),
             mapping,
+            seccomp_action,
             _region,
         })
     }
@@ -456,9 +461,18 @@ impl VirtioDevice for Pmem {
 
             let paused = self.paused.clone();
             let mut epoll_threads = Vec::new();
+            // Retrieve seccomp filter for virtio_pmem thread
+            let virtio_pmem_seccomp_filter =
+                get_seccomp_filter(&self.seccomp_action, Thread::VirtioPmem)
+                    .map_err(ActivateError::CreateSeccompFilter)?;
             thread::Builder::new()
                 .name("virtio_pmem".to_string())
-                .spawn(move || handler.run(paused))
+                .spawn(move || {
+                    SeccompFilter::apply(virtio_pmem_seccomp_filter)
+                        .map_err(DeviceError::ApplySeccompFilter)?;
+
+                    handler.run(paused)
+                })
                 .map(|thread| epoll_threads.push(thread))
                 .map_err(|e| {
                     error!("failed to clone virtio-pmem epoll thread: {}", e);

virtio-devices/src/seccomp_filters.rs

@@ -13,6 +13,7 @@ pub enum Thread {
     VirtioBlk,
     VirtioConsole,
     VirtioNet,
+    VirtioPmem,
     VirtioRng,
 }
 
@@ -97,6 +98,26 @@ fn virtio_net_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
     ])
 }
 
+fn virtio_pmem_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
+    Ok(vec![
+        allow_syscall(libc::SYS_close),
+        allow_syscall(libc::SYS_epoll_create1),
+        allow_syscall(libc::SYS_epoll_ctl),
+        allow_syscall(libc::SYS_epoll_pwait),
+        #[cfg(target_arch = "x86_64")]
+        allow_syscall(libc::SYS_epoll_wait),
+        allow_syscall(libc::SYS_exit),
+        allow_syscall(libc::SYS_fsync),
+        allow_syscall(libc::SYS_futex),
+        allow_syscall(libc::SYS_madvise),
+        allow_syscall(libc::SYS_munmap),
+        allow_syscall(libc::SYS_read),
+        allow_syscall(libc::SYS_rt_sigprocmask),
+        allow_syscall(libc::SYS_sigaltstack),
+        allow_syscall(libc::SYS_write),
+    ])
+}
+
 fn virtio_rng_thread_rules() -> Result<Vec<SyscallRuleSet>, Error> {
     Ok(vec![
         allow_syscall(libc::SYS_close),
@@ -126,6 +147,7 @@ fn get_seccomp_filter_trap(thread_type: Thread) -> Result<SeccompFilter, Error>
         Thread::VirtioBlk => virtio_blk_thread_rules()?,
         Thread::VirtioConsole => virtio_console_thread_rules()?,
         Thread::VirtioNet => virtio_net_thread_rules()?,
+        Thread::VirtioPmem => virtio_pmem_thread_rules()?,
         Thread::VirtioRng => virtio_rng_thread_rules()?,
     };
 
@@ -140,6 +162,7 @@ fn get_seccomp_filter_log(thread_type: Thread) -> Result<SeccompFilter, Error> {
         Thread::VirtioBlk => virtio_blk_thread_rules()?,
         Thread::VirtioConsole => virtio_console_thread_rules()?,
         Thread::VirtioNet => virtio_net_thread_rules()?,
+        Thread::VirtioPmem => virtio_pmem_thread_rules()?,
         Thread::VirtioRng => virtio_rng_thread_rules()?,
     };
 

vmm/src/device_manager.rs

@@ -2302,6 +2302,7 @@ impl DeviceManager {
                 mapping,
                 mmap_region,
                 pmem_cfg.iommu,
+                self.seccomp_action.clone(),
             )
             .map_err(DeviceManagerError::CreateVirtioPmem)?,
         ));