mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-12-26 21:38:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/block_device.policy

43 lines
840 B
Text
Raw Normal View History

crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
close: 1
dup: 1
dup2: 1
exit_group: 1
devices: block: implement discard and write zeroes Discard and Write Zeroes commands have been added to the virtio block specification: https://github.com/oasis-tcs/virtio-spec/commit/88c8553838346b26be4460485cc57c38850b36f7 Implement both commands using the WriteZeroes trait. BUG=chromium:850998 TEST=fstrim within termina on a writable qcow image Change-Id: I33e54e303202328c10f7f2d6e69ab19f419f3998 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1188680 Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-08-24 19:49:05 +00:00
fallocate: 1
qcow: Call fsync(2) when we want to flush to disk Signal to the OS that we want these writes committed all the way to disk. Replace an existing call to flush as that's not sufficient. Change-Id: I9df9e55d2182e283e15eebc02a54c1ce08434f42 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1060696 Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-16 03:18:41 +00:00
fdatasync: 1
crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
fstat64: 1
qcow: Call fsync(2) when we want to flush to disk Signal to the OS that we want these writes committed all the way to disk. Replace an existing call to flush as that's not sufficient. Change-Id: I9df9e55d2182e283e15eebc02a54c1ce08434f42 Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1060696 Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-16 03:18:41 +00:00
fsync: 1
crosvm: aarch64: fix seccomp entry for ftruncate on aarch64 Aarch64 seems to use ftruncate64 rather than ftruncate. BUG=chromium:816692 TEST=run VM on kevin using concierge Change-Id: I944f52d75fb9f5a3aaf5fe9e85708c48f249bb1a Reviewed-on: https://chromium-review.googlesource.com/1031175 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-26 20:19:33 +00:00
ftruncate64: 1
crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
futex: 1
crosvm: aarch64: whitelist gettimeofday for error messages It looks like on ARM we use the real gettimeofday system call when we're outputting error messages, so we need to whitelist this to avoid crashing instead of seeing the error messages. BUG=chromium:843807 TEST=run vm_CrosVmStart and make sure there are no crashes for crosvm Change-Id: I9f47da8dabe31f0677bcaa1d431e56545e20c9c9 Reviewed-on: https://chromium-review.googlesource.com/1081390 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-06-01 00:35:02 +00:00
gettimeofday: 1
crosvm: aarch64 guest support - removes old ARMv7a (32-bit) bindings as we're only supporting aarch64 guests right now - switches both ARMv7 and aarch64 builds to use aarch64 kvm bindings - adds support for ARMv8 Linux guest with dynamic flattened-device-tree CQ-DEPEND=990894 BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on caroline TEST=crosvm runs on kevin built with USE="kvm_host" Change-Id: I7fc4fc4017ed87fd23a1bc50e3ebb05377040006 Reviewed-on: https://chromium-review.googlesource.com/969987 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-27 01:27:40 +00:00
_llseek: 1
# Disallow mmap with PROT_EXEC set. The syntax here doesn't allow bit
# negation, thus the manually negated mask constant.
mmap2: arg2 in 0xfffffffb
mprotect: arg2 in 0xfffffffb
munmap: 1
read: 1
recv: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
clone: arg0 & 0x00010000
write: 1
eventfd2: 1
poll: 1
ppoll: 1
getpid: 1
# Allow PR_SET_NAME only.
prctl: arg0 == 15
restart_syscall: 1
devices: block: use PollContext in block device Switching to PollContext so that there is one less user of Poller, which will be removed. TEST=run any vm with a block device BUG=chromium:816692 Change-Id: I2e1301ea9d66012262f1fcb69eaeee9f7464f3b3 Reviewed-on: https://chromium-review.googlesource.com/983036 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2018-03-28 09:19:33 +00:00
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
devices: block: allow timerfd syscalls in seccomp "devices: block: Flush a minute after a write" introduced new timerfd_ syscalls into the block device but did not add them to the seccomp whitelist. BUG=chromium:885238 TEST=Run crosvm in multiprocess mode and verify that it boots Change-Id: I1568946c64d86ab7dba535a430a8cbe235f64454 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1231513 Commit-Ready: Dylan Reid <dgreid@chromium.org> Tested-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-09-18 17:27:34 +00:00
timerfd_create: 1
timerfd_gettime: 1
timerfd_settime: 1
Reference in a new issue Copy permalink