mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 02:25:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/wl_device.policy

22 lines
750 B
Text
Raw Normal View History

crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
seccomp: refactor policy into common_device.policy CQ-DEPEND=CL:1449895 BUG=None TEST=vmc start termina Change-Id: Ia3edaafc1d2958bd40e6b1adc89dd5e29b679b06 Reviewed-on: https://chromium-review.googlesource.com/1448292 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2019-02-01 00:55:59 +00:00
@include /usr/share/policy/crosvm/common_device.policy
crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
virtwl: implement dmabuf sync support This provides proper synchronization for guest access to DMABufs. Virtio wayland device is given access to the DMA_BUF_SYNC ioctl in order to implement this. Being able to use this directly in the virtio wayland device process is important as these calls can sometimes be relatively expensive and they are frequent enough that avoiding another context switch is useful for good performance. TEST=cache-line artifacts no longer noticeable BUG=chromium:837209 Change-Id: Ibb8d7c01f70ed5b74afd69288015a65186fec52a Reviewed-on: https://chromium-review.googlesource.com/1076928 Commit-Ready: David Reveman <reveman@chromium.org> Tested-by: David Reveman <reveman@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-23 10:41:30 +00:00
# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC
ioctl: arg1 == 0x5421 || arg1 == 0x40086200
seccomp: whitelist connect for wl_device The path to the wayland socket changed, so the previous whitelist based on the connect() arg2 sockaddr_un size now fails. BUG=None TEST=Verify that release build of crosvm starts again on chromebook Change-Id: I3c30977e7c1487b937d69e1dbce4b7fd87136978 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1234827 Reviewed-by: David Riley <davidriley@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-09-19 22:36:22 +00:00
connect: 1
seccomp: remove redundant unconditional arm/arm64 rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: Ic43d1fd13f9c012641d71e526942229eb8b08ed4 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2034024 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2020-02-01 01:29:45 +00:00
open: return ENOENT
openat: return ENOENT
crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
memfd_create: arg1 == 3
# Used to set of size new memfd
crosvm: aarch64: fix truncate on wayland policy Like block_device, also needs to use ftruncate64 instead of ftruncate. BUG=chromium:840048 TEST=manual test of graphics on kevin Change-Id: Ib24b12fd681c96ecc2fec796fe480e94a96a0626 Reviewed-on: https://chromium-review.googlesource.com/1050916 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-09 02:05:28 +00:00
ftruncate64: 1
crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
# Used to determine shm size after recvmsg with fd
_llseek: 1
wl: add pipe2 and fcntl64 to wl_device.policy These syscalls were added to the x86 policy when vfd pipe support was added, but they were never added to the arm version, for whatever reason. This is needed to keep crosvm from getting killed by SIGSYS whenver the user copies to or from guest applications. BUG=chromium:864218 TEST=on kevin, copy/paste to/from gedit Change-Id: Ibe385d50e367c362e911badd640bab2c98e07030 Reviewed-on: https://chromium-review.googlesource.com/1145876 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-07-20 23:47:21 +00:00
# Allow F_GETFL only
fcntl64: arg1 == 3
Reference in a new issue Copy permalink