mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/aarch64/9p_device.policy

30 lines
509 B
Text
Raw Normal View History

seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
seccomp: Allow 9p device to use open/openat This allows us to use export a directory to a VM with the '--shared-dir tag:/dir' crosvm command line flag without relying on seneschal. The fs device's policy already does the same. BUG=b:123309049 TEST=Start tot ARCVM, run 'mkdir /var/run/arc/arcvm && mount -t 9p -o "trans=virtio,version=9p2000.L,cache=none,access=any" host_generated /var/run/arc/arcvm && ls /var/run/arc/arcvm', verify ls prints files. Change-Id: I8f8b265fc8a7de159508afbee5114b6a3f084d01 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1995319 Tested-by: Yusuke Sato <yusukes@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Lepton Wu <lepton@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Yusuke Sato <yusukes@chromium.org>
2020-01-11 00:01:11 +00:00
openat: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
@include /usr/share/policy/crosvm/common_device.policy
pread64: 1
pwrite64: 1
statx: 1
fstat: 1
ioctl: arg1 == FIOCLEX
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
lseek: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
getdents64: 1
fdatasync: 1
fsync: 1
mkdirat: 1
renameat: 1
linkat: 1
unlinkat: 1
socket: arg0 == AF_UNIX
utimensat: 1
ftruncate: 1
seccomp: 9p: Allow fchown and fchmod Needed by upcoming implementation changes. BUG=chromium:1082345,chromium:920262,chromium:912599 TEST=`emerge-$BOARD crosvm` Change-Id: Id366cd9d0bb3af24e2445fdf897d6ef45ae88115 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2784163 Auto-Submit: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-24 09:33:03 +00:00
fchmod: 1
fchown: 1
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
fstatfs: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
newfstatat: 1
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-19 19:59:38 +00:00
prctl: arg0 == PR_SET_NAME
Reference in a new issue Copy permalink