seccomp: really fix blocking of setns/execveat/unshare

[PATCH] seccomp: really fix blocking of setns/execveat/unshare

Posted by Daniel P. Berrangé 1 week, 3 days ago

The previous fix for setns/execveat/unshare mistakenly copy and
pasted the clone_args filter, which is inappropriate for these
syscalls and had the effect of weakening the seccomp filter.

Fixes: f33fb19cab (seccomp: fix blocking of setns/execveat/unshare)
Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/4671
Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>
---
 system/qemu-seccomp.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/system/qemu-seccomp.c b/system/qemu-seccomp.c
index 3889d48b4f2..cd2c1b0b747 100644
--- a/system/qemu-seccomp.c
+++ b/system/qemu-seccomp.c
@@ -250,12 +250,12 @@ static const struct QemuSeccompSyscall denylist[] = {
 #endif
 #ifdef __SNR_execveat
     { SCMP_SYS(execveat),               QEMU_SECCOMP_SET_SPAWN,
-      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+      0, NULL, SCMP_ACT_ERRNO(EPERM) },
 #endif
     { SCMP_SYS(setns),                  QEMU_SECCOMP_SET_SPAWN,
-      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+      0, NULL, SCMP_ACT_ERRNO(EPERM) },
     { SCMP_SYS(unshare),                QEMU_SECCOMP_SET_SPAWN,
-      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
+      0, NULL, SCMP_ACT_ERRNO(EPERM) },
     /* resource control */
     { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL,
       0, NULL, SCMP_ACT_ERRNO(EPERM) },
-- 
2.56.0

Re: [PATCH] seccomp: really fix blocking of setns/execveat/unshare

Posted by Marc-André Lureau 1 week, 3 days ago

On Mon, Oct 12, 2026 at 2:13 PM Daniel P. Berrangé <berrange@redhat.com> wrote:
>
> The previous fix for setns/execveat/unshare mistakenly copy and
> pasted the clone_args filter, which is inappropriate for these
> syscalls and had the effect of weakening the seccomp filter.
>
> Fixes: f33fb19cab (seccomp: fix blocking of setns/execveat/unshare)
> Fixes: https://gitlab.com/qemu-project/qemu/-/work_items/4671
> Signed-off-by: Daniel P. Berrangé <berrange@redhat.com>

Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>

> ---
>  system/qemu-seccomp.c | 6 +++---
>  1 file changed, 3 insertions(+), 3 deletions(-)
>
> diff --git a/system/qemu-seccomp.c b/system/qemu-seccomp.c
> index 3889d48b4f2..cd2c1b0b747 100644
> --- a/system/qemu-seccomp.c
> +++ b/system/qemu-seccomp.c
> @@ -250,12 +250,12 @@ static const struct QemuSeccompSyscall denylist[] = {
>  #endif
>  #ifdef __SNR_execveat
>      { SCMP_SYS(execveat),               QEMU_SECCOMP_SET_SPAWN,
> -      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
> +      0, NULL, SCMP_ACT_ERRNO(EPERM) },
>  #endif
>      { SCMP_SYS(setns),                  QEMU_SECCOMP_SET_SPAWN,
> -      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
> +      0, NULL, SCMP_ACT_ERRNO(EPERM) },
>      { SCMP_SYS(unshare),                QEMU_SECCOMP_SET_SPAWN,
> -      ARRAY_SIZE(clone_arg_none), clone_arg_none, SCMP_ACT_ERRNO(EPERM) },
> +      0, NULL, SCMP_ACT_ERRNO(EPERM) },
>      /* resource control */
>      { SCMP_SYS(setpriority),            QEMU_SECCOMP_SET_RESOURCECTL,
>        0, NULL, SCMP_ACT_ERRNO(EPERM) },
> --
> 2.56.0
>
>


-- 
Marc-André Lureau