mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/aarch64/gpu_common.policy

94 lines
1.9 KiB
Text
Raw Normal View History

seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-01 21:25:41 +00:00
# Copyright 2021 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Rules from common_device.policy with some rules removed because they block certain flags needed
# for gpu.
brk: 1
seccomp: allow clock_gettime in all devices This was already allowed in common_device.policy for arm platforms, and it can be called via future/async code that is used by many devices. Add it to x86_64 and aarch64 common policies as well. BUG=b:220908060 TEST=Start Crostini with virtio-snd on hatch and trogdo Change-Id: I9bf8f56ebed0cfe6d5e17e45226cac73db3d6d37 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3482026 Reviewed-by: Dmitry Torokhov <dtor@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-02-22 21:05:08 +00:00
clock_gettime: 1
seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-01 21:25:41 +00:00
close: 1
dup3: 1
dup: 1
epoll_create1: 1
epoll_ctl: 1
epoll_pwait: 1
eventfd2: 1
exit: 1
exit_group: 1
futex: 1
getcwd: 1
getpid: 1
seccomp: Fixes needed for aarch64 to allow arcvm to start With these changes arcvm starts when running with 64-bit userspace and this grep turns up blank: grep SECCOMP /var/log/audit/audit.log Generated by: * Hacking minijail0 to always log <https://r.android.com/2072091> and making sure it was compiled in debug mode. * Hacking "crosvm run" to be "crosvm run --seccomp-log-failures". I don't truly know if this is needed but it didn't hurt. * Diffing arm vs. arm64 From comparing arm vs. arm64 there could still be some things missing, or it's possible that arm has simply accumulated some cruft. More can be added later if we find it's needed. BUG=b:223410173, b:230609113 TEST=Start arcvm; start android-sh; run tast arc.VMConfig Change-Id: Ib5407ddecc3d19f43e14e5b036ac64baee9335bb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3543889 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Auto-Submit: Douglas Anderson <dianders@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Douglas Anderson <dianders@chromium.org>
2022-03-22 21:45:22 +00:00
gettid: 1
seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-01 21:25:41 +00:00
gettimeofday: 1
kill: 1
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
mremap: 1
munmap: 1
nanosleep: 1
clock_nanosleep: 1
pipe2: 1
ppoll: 1
read: 1
readlinkat: 1
readv: 1
recvfrom: 1
recvmsg: 1
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
rt_sigreturn: 1
sched_getaffinity: 1
seccomp: add sched_yield for arm64 We already allow the system call in arm32. Testing revealed that the call is actually in use. BUG=b:231660764, b:230609113 TEST=cheets_CTS_R.internal.arm.CtsSkQP Change-Id: Ia04089d1454312ac637e5c76d0aceafd2ab55134 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3632320 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Douglas Anderson <dianders@chromium.org> Commit-Queue: Douglas Anderson <dianders@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2022-05-06 15:23:32 +00:00
sched_yield: 1
seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-01 21:25:41 +00:00
sendmsg: 1
sendto: 1
set_robust_list: 1
sigaltstack: 1
write: 1
writev: 1
uname: 1
# Required for perfetto tracing
getsockopt: 1
shutdown: 1
## Rules specific to gpu
connect: 1
getrandom: 1
lseek: 1
ftruncate: 1
statx: 1
fstat: 1
newfstatat: 1
getdents64: 1
sysinfo: 1
fstatfs: 1
seccomp: Move prctl in gpu_common to gpu-specific section The top part of gpu_common.policy is supposed to match common_device.policy, but "prctl" is in this top part and isn't in common_device.policy. A bit of history: * prctl used to be in the common_device.policy but was removed in <https://crrev.com/c/2837307>. * Even when prctl was in common_device.policy, it had different arguments than what we allow in gpu_common.policy. This is a no-op cleanup change. BUG=None TEST=None Change-Id: Ic71c9da3ef9eb24665711d2000416ff9c87d49a1 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3631410 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Douglas Anderson <dianders@chromium.org>
2022-05-06 20:32:25 +00:00
prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-01 21:25:41 +00:00
# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543
seccomp: Add memfd_create: arg1 == 3 for arm64 With testing, we're seeing secomp violations on aarch64. We need to give access to "memfd_create" just like we did for arm32. Copy the snippet from there. BUG=b:223410173, b:230609113 TEST=Start arcvm; start android-sh; run tast arc.VMConfig Change-Id: I4922e6decd67c3bc23fb090987b0318c384e0d68 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3626017 Auto-Submit: Douglas Anderson <dianders@chromium.org> Reviewed-by: Rob Clark <robdclark@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Dennis Kempin <denniskempin@google.com>
2022-05-03 23:28:31 +00:00
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
memfd_create: arg1 == 3
seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com>
2021-12-01 21:25:41 +00:00
## mmap/mprotect differ from the common_device.policy
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
openat: 1
## Rules specific to pvr
geteuid: 1
getuid: 1
fcntl: 1
tgkill: 1
# Rules specific to Mesa.
sched_setscheduler: 1
sched_setaffinity: 1
kcmp: 1
seccomp: Fixes needed for aarch64 to allow arcvm to start With these changes arcvm starts when running with 64-bit userspace and this grep turns up blank: grep SECCOMP /var/log/audit/audit.log Generated by: * Hacking minijail0 to always log <https://r.android.com/2072091> and making sure it was compiled in debug mode. * Hacking "crosvm run" to be "crosvm run --seccomp-log-failures". I don't truly know if this is needed but it didn't hurt. * Diffing arm vs. arm64 From comparing arm vs. arm64 there could still be some things missing, or it's possible that arm has simply accumulated some cruft. More can be added later if we find it's needed. BUG=b:223410173, b:230609113 TEST=Start arcvm; start android-sh; run tast arc.VMConfig Change-Id: Ib5407ddecc3d19f43e14e5b036ac64baee9335bb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3543889 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Auto-Submit: Douglas Anderson <dianders@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Douglas Anderson <dianders@chromium.org>
2022-03-22 21:45:22 +00:00
# Rules for Vulkan loader / layers
faccessat: 1
faccessat2: 1
getgid: 1
getegid: 1
Reference in a new issue Copy permalink