From 6929309a908bd7b6e25601df3ae84922694957e8 Mon Sep 17 00:00:00 2001
From: Wei Gao <gaowei66@huawei.com>
Date: Tue, 23 Feb 2021 08:40:26 +0800
Subject: [PATCH 1/3] bug-fix: fix some bugs in seccomp filter.

1. add three syscall in allow_list for virtio-blk device on `direct=off`.
2. fix when balloon is set in json file, seccomp balloon filter not make effect.
3. delete five unnecessary syscall in balloon allow list.

Signed-off-by: Wei Gao <gaowei66@huawei.com>
---
 device_model/src/micro_vm/micro_syscall.rs | 7 ++-----
 device_model/src/virtio/balloon.rs         | 5 -----
 docs/config_guidebook.md                   | 2 +-
 src/main.rs                                | 4 +++-
 4 files changed, 6 insertions(+), 12 deletions(-)

diff --git a/device_model/src/micro_vm/micro_syscall.rs b/device_model/src/micro_vm/micro_syscall.rs
index b333fb3..97be190 100644
--- a/device_model/src/micro_vm/micro_syscall.rs
+++ b/device_model/src/micro_vm/micro_syscall.rs
@@ -51,8 +51,8 @@ const KVM_SET_DEVICE_ATTR: u32 = 0x4018_aee1;
 ///
 /// # Notes
 /// This allowlist limit syscall with:
-/// * x86_64-unknown-gnu: 36 syscalls
-/// * x86_64-unknown-musl: 36 syscalls
+/// * x86_64-unknown-gnu: 39 syscalls
+/// * x86_64-unknown-musl: 39 syscalls
 /// * aarch64-unknown-gnu: 38 syscalls
 /// * aarch64-unknown-musl: 38 syscalls
 /// To reduce performance losses, the syscall rules is ordered by frequency.
@@ -85,7 +85,6 @@ pub fn syscall_allow_list() -> Vec<BpfRule> {
         BpfRule::new(libc::SYS_rt_sigprocmask),
         #[cfg(target_arch = "x86_64")]
         BpfRule::new(libc::SYS_open),
-        #[cfg(target_arch = "aarch64")]
         BpfRule::new(libc::SYS_openat),
         BpfRule::new(libc::SYS_sigaltstack),
         BpfRule::new(libc::SYS_mmap),
@@ -108,9 +107,7 @@ pub fn syscall_allow_list() -> Vec<BpfRule> {
         BpfRule::new(libc::SYS_gettid),
         BpfRule::new(libc::SYS_getpid),
         BpfRule::new(libc::SYS_fstat),
-        #[cfg(target_arch = "aarch64")]
         BpfRule::new(libc::SYS_pread64),
-        #[cfg(target_arch = "aarch64")]
         BpfRule::new(libc::SYS_pwrite64),
         BpfRule::new(libc::SYS_statx),
         #[cfg(target_arch = "x86_64")]
diff --git a/device_model/src/virtio/balloon.rs b/device_model/src/virtio/balloon.rs
index f50fa82..b9fa536 100644
--- a/device_model/src/virtio/balloon.rs
+++ b/device_model/src/virtio/balloon.rs
@@ -894,11 +894,6 @@ pub fn qmp_query_balloon() -> Option<u64> {
 /// Create a syscall bpf rule for device `Balloon`.
 pub fn balloon_allow_list(syscall_allow_list: &mut Vec<BpfRule>) {
     syscall_allow_list.extend(vec![
-        BpfRule::new(libc::SYS_mprotect),
-        BpfRule::new(libc::SYS_clone),
-        BpfRule::new(libc::SYS_set_robust_list),
-        BpfRule::new(libc::SYS_sched_getaffinity),
-        BpfRule::new(libc::SYS_nanosleep),
         BpfRule::new(libc::SYS_timerfd_create),
         BpfRule::new(libc::SYS_timerfd_settime),
         BpfRule::new(libc::SYS_timerfd_gettime),
diff --git a/docs/config_guidebook.md b/docs/config_guidebook.md
index a0143fc..936676c 100644
--- a/docs/config_guidebook.md
+++ b/docs/config_guidebook.md
@@ -593,7 +593,7 @@ And you can also restore StratoVirt's **pid number** to a file by:
 ### 4.2 Seccomp
 
 StratoVirt use [seccomp(2)](https://man7.org/linux/man-pages/man2/seccomp.2.html) to limit the syscalls
-in StratoVirt process by default. StratoVirt use only 36 syscalls in x86_64 (38 syscalls in aarch64) after running. 
+in StratoVirt process by default. StratoVirt use only 39 syscalls in x86_64 (38 syscalls in aarch64) after running. 
 It will make a slight influence on performance to StratoVirt. If you want to disable seccomp, you can
 run StratoVirt with `-disable-seccomp`.
 
diff --git a/src/main.rs b/src/main.rs
index ec955a2..e6dffbc 100644
--- a/src/main.rs
+++ b/src/main.rs
@@ -117,6 +117,8 @@ fn run() -> Result<()> {
 }
 
 fn real_main(cmd_args: &arg_parser::ArgMatches, vm_config: VmConfig) -> Result<()> {
+    let balloon_switch_on = vm_config.balloon.is_some();
+
     if cmd_args.is_present("daemonize") {
         match daemonize(cmd_args.value_of("pidfile")) {
             Ok(()) => info!("Daemonize mode start!"),
@@ -161,7 +163,7 @@ fn real_main(cmd_args: &arg_parser::ArgMatches, vm_config: VmConfig) -> Result<(
 
     if !cmd_args.is_present("disable-seccomp") {
         let mut allow_list = syscall_allow_list();
-        if cmd_args.is_present("balloon") {
+        if balloon_switch_on {
             balloon_allow_list(&mut allow_list);
         }
         register_seccomp(allow_list)?;
-- 
2.27.0

