Skip to content

[blk-threaded - 9/12] seccomp: add block worker thread filter #6131

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
PierreBertholom wants to merge 4 commits into from
+699 −30
Open

[blk-threaded - 9/12] seccomp: add block worker thread filter #6131

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
d479864
seccompiler: truncate memfd before each BPF export
PierreBertholom Aug 13, 2026
eb14a03
test: fix x86 regs for seccomp static analysis
PierreBertholom Jul 29, 2026
5af5104
seccomp: add block worker thread filter
PierreBertholom Aug 13, 2026
e3a30b2
docs: document seccomp thread categories
PierreBertholom Aug 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 6 additions & 2 deletions docs/seccompiler.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -77,8 +77,11 @@ This means that Firecracker has a JSON file for each supported target (currently
determined by the arch-libc combinations). You can view them in
`resources/seccomp`.

At the top level, the file requires an object that maps thread categories (vmm,
api and vcpu) to seccomp filters:
At the top level, the file contains an object that maps thread categories to
seccomp filters. Firecracker allows the `vmm`, `api`, `vcpu`, and `blk_worker`
categories. The `vmm`, `api`, and `vcpu` categories are mandatory. The
`blk_worker` category is optional and is needed only when a block device uses a
dedicated worker thread.

```
{
Expand All @@ -91,6 +94,7 @@ api and vcpu) to seccomp filters:
},
"api": {...},
"vcpu": {...},
"blk_worker": {...}
}
```

Expand Down
298 changes: 298 additions & 0 deletions resources/seccomp/aarch64-unknown-linux-musl.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,10 @@
"syscall": "newfstatat",
"comment": "Used when creating snapshots in vmm:persist::snapshot_memory_to_file through std::fs::File::metadata"
},
{
"syscall": "epoll_create1",
"comment": "Used by the threaded block worker's EventManager::new(), which runs on the spawned worker thread under the inherited vmm filter before it applies its own blk_worker filter"
},
{
"syscall": "epoll_ctl"
},
Expand Down Expand Up @@ -392,6 +396,28 @@
}
]
},
{
"syscall": "mmap",
"comment": "Used to allocate the threaded block worker's thread stack (spawned from the VMM thread, so checked against this inherited filter)",
"args": [
{
"index": 3,
"type": "dword",
"op": "eq",
"val": 131106,
"comment": "libc::MAP_PRIVATE | libc::MAP_ANONYMOUS | libc::MAP_STACK"
},
{
"index": 2,
"type": "dword",
"op": {
"masked_eq": 4
},
"val": 0,
"comment": "Ensure PROT_EXEC is not set"
}
]
},
{
"syscall": "memfd_create",
"comment": "Used by IovDeque ring buffer for net device hotplug",
Expand All @@ -418,6 +444,19 @@
}
]
},
{
"syscall": "fcntl",
"comment": "Used by EventFd::try_clone() when spawning the threaded block worker (control_evt/queue_evts duplication on the VMM thread)",
"args": [
{
"index": 1,
"type": "dword",
"op": "eq",
"val": 1030,
"comment": "F_DUPFD_CLOEXEC"
}
]
},
{
"syscall": "rt_sigaction",
"comment": "rt_sigaction is used by libc::abort during a panic to install the default handler for SIGABRT",
Expand Down Expand Up @@ -712,6 +751,70 @@
"comment": "Ensure PROT_EXEC is not set"
}
]
},
{
"syscall": "clone",
"comment": "Used by musl pthread_create to spawn the block worker thread",
"args": [
{
"index": 0,
"type": "dword",
"op": {"masked_eq": 4290772991},
"val": 4001536,
"comment": "Require the pthread clone flags and allow only the optional obsolete CLONE_DETACHED bit"
}
]
},
{
"syscall": "prctl",
"comment": "Used by musl to set the block worker thread name",
"args": [
{
"index": 0,
"type": "dword",
"op": "eq",
"val": 15,
"comment": "PR_SET_NAME"
}
]
},
{
"syscall": "prctl",
"comment": "Used to set no_new_privs before applying the block worker seccomp filter",
"args": [
{
"index": 0,
"type": "dword",
"op": "eq",
"val": 38,
"comment": "PR_SET_NO_NEW_PRIVS"
},
{
"index": 1,
"type": "dword",
"op": "eq",
"val": 1
}
]
},
{
"syscall": "seccomp",
"comment": "Used to apply the block worker seccomp filter",
"args": [
{
"index": 0,
"type": "dword",
"op": "eq",
"val": 1,
"comment": "SECCOMP_SET_MODE_FILTER"
},
{
"index": 1,
"type": "dword",
"op": "eq",
"val": 0
}
]
}
]
},
Expand Down Expand Up @@ -1349,5 +1452,200 @@
]
}
]
},
"blk_worker": {
"default_action": "trap",
"filter_action": "allow",
"filter": [
{
"syscall": "epoll_ctl"
},
{
"syscall": "epoll_pwait"
},
{
"syscall": "lseek",
"comment": "SyncFileEngine seeks to the request offset before each read/write"
},
{
"syscall": "futex",
"comment": "Locking the Arc<Mutex<ThreadedWorker>> data path"
},
{
"syscall": "mmap",
"comment": "Allocator growth during I/O",
"args": [
{
"index": 3,
"type": "dword",
"op": "eq",
"val": 34,
"comment": "libc::MAP_ANONYMOUS | libc::MAP_PRIVATE"
},
{
"index": 2,
"type": "dword",
"op": {"masked_eq": 4},
"val": 0,
"comment": "Ensure PROT_EXEC is not set"
}
]
},
{
"syscall": "mmap",
"comment": "Used by io_uring for mapping the queues during drive patch",
"args": [
{
"index": 3,
"type": "dword",
"op": "eq",
"val": 32769,
"comment": "libc::MAP_SHARED | libc::MAP_POPULATE"
},
{
"index": 2,
"type": "dword",
"op": {"masked_eq": 4},
"val": 0,
"comment": "Ensure PROT_EXEC is not set"
}
]
},
{
"syscall": "mmap",
"comment": "Used for reading the timezone in LocalTime::now()",
"args": [
{
"index": 3,
"type": "dword",
"op": "eq",
"val": 1,
"comment": "libc::MAP_SHARED"
},
{
"index": 2,
"type": "dword",
"op": {"masked_eq": 4},
"val": 0,
"comment": "Ensure PROT_EXEC is not set"
}
]
},
{
"syscall": "munmap"
},
{
"syscall": "sigaltstack"
},
{
"syscall": "rt_sigprocmask"
},
{
"syscall": "rt_sigaction",

@Manciukic Manciukic Aug 26, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

we should also have rt_sigreturn which is used to return from signal handler if it happens to receive a signal in the worker thread. We recently caught a bug where api thread was missing it.

"comment": "rt_sigaction is used by libc::abort during a panic to install the default handler for SIGABRT",
"args": [
{
"index": 0,
"type": "dword",
"op": "eq",
"val": 6,
"comment": "SIGABRT"
}
]
},
{
"syscall": "exit",
"comment": "Worker thread exit on Finish"
},
{
"syscall": "exit_group",
"comment": "Used by the fatal signal handlers (vmm::signal_handler::exit_with_code) to terminate the process"
},
{
"syscall": "tkill",
"comment": "tkill is used by libc::abort during a panic to raise SIGABRT",
"args": [
{
"index": 1,
"type": "dword",
"op": "eq",
"val": 6,
"comment": "SIGABRT"
}
]
},
{
"syscall": "read"
},
{
"syscall": "write"
},
{
"syscall": "fsync"
},
{
"syscall": "openat",
"comment": "Used to open the replacement backing file during drive patch and rescan"
},
{
"syscall": "close"
},
{
"syscall": "io_uring_enter",
"comment": "Used for submitting io_uring requests"
},
{
"syscall": "io_uring_setup",
"comment": "Rebuilding the io_uring ring on the worker thread during drive patch (update_file)"
},
{
"syscall": "io_uring_register",
"comment": "Registering fixed fds/opcode restrictions when rebuilding the ring on drive patch"
},
{
"syscall": "gettid",
"comment": "Rust std uses it during panic to print the thread id."
},
{
"syscall": "clock_gettime",
"comment": "Used for metrics and logging, via the helpers in utils/src/time.rs. It's not called on some platforms, because of vdso optimisations."
},
{
"syscall": "timerfd_settime",
"comment": "Needed for rate limiting and metrics",
"args": [
{
"index": 1,
"type": "dword",
"op": "eq",
"val": 0
}
]
},
{
"syscall": "fcntl",
"comment": "Used by snapshotting, drive patching and rescanning",
"args": [
{
"index": 1,
"type": "dword",
"op": "eq",
"val": 2,
"comment": "FCNTL_F_SETFD"
},
{
"index": 2,
"type": "dword",
"op": "eq",
"val": 1,
"comment": "FCNTL_FD_CLOEXEC"
}
]
},
{
"syscall": "fstat",
"comment": "Used by disk update"
}
]
}
}
5 changes: 5 additions & 0 deletions resources/seccomp/unimplemented.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,5 +13,10 @@
"default_action": "allow",
"filter_action": "trap",
"filter": []
},
"blk_worker": {
"default_action": "allow",
"filter_action": "trap",
"filter": []
}
}
Loading
Loading