volt-vmm/docs/phase3-seccomp-fix.md

Phase 3: Seccomp Allowlist Audit & Fix

Status: ✅ COMPLETE

Summary

The seccomp-bpf allowlist and Landlock configuration were audited for correctness. The VM already booted successfully with security features enabled — the Phase 2 implementation included the necessary syscalls. Two additional syscalls (fallocate, ftruncate) were added for production robustness.

Findings

Seccomp Filter

The Phase 2 seccomp allowlist (76 syscalls) already included all syscalls needed for virtio-blk I/O processing:

Syscall	Purpose	Status at Phase 2
pread64	Positional read for block I/O	✅ Already present
pwrite64	Positional write for block I/O	✅ Already present
lseek	File seeking for FileBackend	✅ Already present
fdatasync	Data sync for flush operations	✅ Already present
fstat	File metadata for disk size	✅ Already present
fsync	Full sync for flush operations	✅ Already present
readv/writev	Scatter-gather I/O	✅ Already present
madvise	Memory advisory for guest mem	✅ Already present
mremap	Memory remapping	✅ Already present
eventfd2	Event notification for virtio	✅ Already present
timerfd_create	Timer fd creation	✅ Already present
timerfd_settime	Timer configuration	✅ Already present
ppoll	Polling for events	✅ Already present
epoll_ctl	Epoll event management	✅ Already present
epoll_wait	Epoll event waiting	✅ Already present
epoll_create1	Epoll instance creation	✅ Already present

Syscalls Added in Phase 3

Two additional syscalls were added for production robustness:

Syscall	Purpose	Why Added
fallocate	Pre-allocate disk space	Needed for CoW disk backends, qcow2 expansion, and Stellarium CAS storage
ftruncate	Resize files	Needed for disk resize operations and FileBackend::create()

Landlock Configuration

The Landlock filesystem sandbox was verified correct:

• Kernel image: Read-only access ✅
• Rootfs disk: Read-write access (including Truncate flag) ✅
• Device nodes: /dev/kvm, /dev/net/tun, /dev/vhost-net with IoctlDev ✅
• /proc/self: Read-only access for fd management ✅
• Stellarium volumes: Read-write access when --volume is used ✅
• API socket directory: Socket creation + removal access ✅

Landlock reports "partially enforced" on kernel 6.1 because the code targets ABI V5 (kernel 6.10+) and falls back gracefully. This is expected and correct.

Syscall Trace Analysis

Using strace -f on the secured VMM, the following 17 unique syscalls were observed during steady-state operation (all in the allowlist):

close, epoll_ctl, epoll_wait, exit_group, fsync, futex, ioctl,
lseek, mprotect, munmap, read, recvfrom, rt_sigreturn,
sched_yield, sendto, sigaltstack, write

No SIGSYS signals were generated. No syscalls returned ENOSYS.

Test Results

With Security (Seccomp + Landlock)

$ ./target/release/volt-vmm \
    --kernel comparison/firecracker/vmlinux.bin \
    --rootfs comparison/rootfs.ext4 \
    --memory 128M --cpus 1 --net-backend none

Seccomp filter active: 78 syscalls allowed, all others → KILL_PROCESS
Landlock sandbox partially enforced
VM READY - BOOT TEST PASSED

Without Security (baseline)

$ ./target/release/volt-vmm \
    --kernel comparison/firecracker/vmlinux.bin \
    --rootfs comparison/rootfs.ext4 \
    --memory 128M --cpus 1 --net-backend none \
    --no-seccomp --no-landlock

VM READY - BOOT TEST PASSED

Both modes produce identical boot results. Tested 3 consecutive runs — all passed.

Final Allowlist (78 syscalls)

File I/O (14)

read, write, openat, close, fstat, lseek, pread64, pwrite64, readv, writev, fsync, fdatasync, fallocate★, ftruncate★

Memory (6)

mmap, mprotect, munmap, brk, madvise, mremap

KVM/Device (1)

ioctl

Threading (7)

clone, clone3, futex, set_robust_list, sched_yield, sched_getaffinity, rseq

Signals (4)

rt_sigaction, rt_sigprocmask, rt_sigreturn, sigaltstack

Networking (16)

accept4, bind, listen, socket, connect, recvfrom, sendto, recvmsg, sendmsg, shutdown, getsockname, getpeername, setsockopt, getsockopt, epoll_create1, epoll_ctl, epoll_wait, ppoll

Process (7)

exit, exit_group, getpid, gettid, prctl, arch_prctl, prlimit64, tgkill

Timers (3)

clock_gettime, nanosleep, clock_nanosleep

Misc (18)

getrandom, eventfd2, timerfd_create, timerfd_settime, pipe2, dup, dup2, fcntl, statx, newfstatat, access, readlinkat, getcwd, unlink, unlinkat, mkdir, mkdirat

★ = Added in Phase 3

Phase 2 Handoff Note

The Phase 2 handoff described the VM stalling with "Failed to enable 64-bit or 32-bit DMA" when security was enabled. This issue appears to have been resolved during Phase 2 development — the final committed code includes all necessary syscalls for virtio-blk I/O. The DMA warning message is a kernel-level log that appears in both secured and unsecured boots (it's a virtio-mmio driver message, not a Volt error) and does not prevent boot completion.