mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/9p_device.policy

34 lines
573 B
Text
Raw Normal View History

virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
seccomp: refactor policy into common_device.policy CQ-DEPEND=CL:1449895 BUG=None TEST=vmc start termina Change-Id: Ia3edaafc1d2958bd40e6b1adc89dd5e29b679b06 Reviewed-on: https://chromium-review.googlesource.com/1448292 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2019-02-01 00:55:59 +00:00
@include /usr/share/policy/crosvm/common_device.policy
virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
pread64: 1
pwrite64: 1
stat64: 1
seccomp: allow statx syscall where stat/fstat was allowed This is used in Rust 1.40.0's libstd in place of stat/fstat; update the whitelists to allow the new syscall as well. BUG=chromium:1042461 TEST=`crosvm disk resize` does not trigger seccomp failure Change-Id: Ia3f0e49ee009547295c7af7412dfb5eb3ac1efcb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2003685 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-01-15 21:34:09 +00:00
statx: 1
virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
fstat64: 1
ioctl: arg1 == FIOCLEX
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
_llseek: 1
virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
getdents64: 1
fdatasync: 1
fsync: 1
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
mkdirat: 1
seccomp: remove redundant unconditional arm/arm64 rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: Ic43d1fd13f9c012641d71e526942229eb8b08ed4 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2034024 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2020-02-01 01:29:45 +00:00
open: 1
openat: 1
virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
rmdir: 1
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
renameat: 1
linkat: 1
unlinkat: 1
virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
socket: arg0 == AF_UNIX
utimensat: 1
crosvm: Add utimensat_time64 to arm seccomp Add utimensat_time64 where utimensat is used. BUG=b:185515575 TEST=CQ Change-Id: I2ad841d8f89d779e487a3abf77e158da4ff21bef Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2836891 Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Muhammad Hasan Khan <mhasank@chromium.org>
2021-04-19 18:42:28 +00:00
utimensat_time64: 1
virtio: Implement the 9P device Implement a new virtio_9p device to be used for sharing directories with the VM. BUG=chromium:703939 TEST=mount inside a VM and run `bonnie++ -r 256` Append the shared directory to the crosvm command line: --shared-dir /path/to/dir:test_9p Then mount in the guest: mkdir /tmp/9p mount -t 9p -o trans=virtio test_9p /tmp/9p -oversion=9p2000.L Or for a 9p root: run --shared-dir /mnt/vm_root:/dev/root -p 'root=/dev/root ro rootflags=ro,trans=virtio,version=9p2000.L,cache=loose rootfstype=9p' vmlinux.bin CQ-DEPEND=CL:1065170 Change-Id: I41fc21306ab5fa318a271f172d7057b767b29f31 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1065173 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-17 02:32:04 +00:00
ftruncate64: 1
seccomp: 9p: Allow fchown and fchmod Needed by upcoming implementation changes. BUG=chromium:1082345,chromium:920262,chromium:912599 TEST=`emerge-$BOARD crosvm` Change-Id: Id366cd9d0bb3af24e2445fdf897d6ef45ae88115 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2784163 Auto-Submit: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-24 09:33:03 +00:00
fchmod: 1
fchown: 1
seccomp: Add fstatfs (32bit) to arm policies This is a commit to future-proof seccomp failures with syscall=100, fstatfs. On 32bit systems, we've seen programs which use not just fstatfs64, but also fstatfs. Which one is selected is seemlessly selected via defines via `statvfs`, depending on the board (notably scarlet, trogdor, and elm). See also: https://man7.org/linux/man-pages/man2/statfs.2.html BUG=b:197006863 TEST=CQ Change-Id: I6eaea3064671a109d2d7844cde4eae43931c63bf Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3100412 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-08-17 18:23:08 +00:00
fstatfs: 1
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
fstatfs64: 1
seccomp: Update 9p policy Add newfstatat for x86 and fstatat64 for arm to the seccomp policy file for the 9p device and server program. BUG=chromium:886535 TEST=`vmc share termina foo` and then `ls /mnt/shared` inside the VM works Change-Id: I6871f54ae885e080dca0ea5751987d59c55a59d6 Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1232556 Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-09-19 01:29:15 +00:00
fstatat64: 1
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-19 19:59:38 +00:00
prctl: arg0 == PR_SET_NAME
Reference in a new issue Copy permalink