mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/aarch64/serial.policy

12 lines
374 B
Text
Raw Normal View History

seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
seccomp: define naming rules for policy files We are going to use separate policy files per device for the following scenarios: 1) Regular in-VMM virtio device, 2) Virtio device over vhost-user, 3) Virtio device over Vvu. Each of these scenarios require slightly different policies as a jailed device process needs to allow not only the system calls necessary for the device to function, but also those required by the virtio transport in use. This CL adds a README.md file to the seccomp directory that details the naming and policy inclusion rules, and updates the serial, xhci and coiommu policies to follow the naming scheme. Vhost-user and VVU policy files will be added along with support for jailing devices when they are in use. BUG=b:217480043 TEST=serial device works with `crosvm run`. Change-Id: I6d454aa6e05d00691fe3346e822ed1fc7b24aed8 Signed-off-by: Alexandre Courbot <acourbot@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3706490 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
2022-06-15 07:58:14 +00:00
# Syscalls specific to the serial device. This policy file is not meant to be used directly, but
# rather to be included from another one.
seccomp: remove redundant unconditional arm/arm64 rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: Ic43d1fd13f9c012641d71e526942229eb8b08ed4 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2034024 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2020-02-01 01:29:45 +00:00
crosvm: Support UnixDatagram sockets for serial output. BUG=chromium:1053847 TEST=Listen to the socket from VmLogForwarder, observer messages forwarded into separate output file. Change-Id: Ia472e34b78db599e91f63e72a13bf8539d0d6312 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2287077 Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Nicholas Verne <nverne@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Nicholas Verne <nverne@chromium.org> Auto-Submit: Nicholas Verne <nverne@chromium.org>
2020-07-08 07:19:55 +00:00
connect: 1
bind: 1
seccomp: remove redundant unconditional arm/arm64 rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: Ic43d1fd13f9c012641d71e526942229eb8b08ed4 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2034024 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2020-02-01 01:29:45 +00:00
openat: return ENOENT
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-19 19:59:38 +00:00
prctl: arg0 == PR_SET_NAME
Reference in a new issue Copy permalink