mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-10 12:09:31 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/aarch64/9p_device.policy

31 lines
501 B
Text
Raw Normal View History

Update all copyright headers to match new style This search/replace updates all copyright notices to drop the "All rights reserved", Use "ChromiumOS" instead of "Chromium OS" and drops the trailing dots. This fulfills the request from legal and unifies our notices. ./tools/health-check has been updated to only accept this style. BUG=b:246579983 TEST=./tools/health-check Change-Id: I87a80701dc651f1baf4820e5cc42469d7c5f5bf7 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3894243 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Dennis Kempin <denniskempin@google.com>
2022-09-13 17:55:17 +00:00
# Copyright 2019 The ChromiumOS Authors
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
seccomp: Allow 9p device to use open/openat This allows us to use export a directory to a VM with the '--shared-dir tag:/dir' crosvm command line flag without relying on seneschal. The fs device's policy already does the same. BUG=b:123309049 TEST=Start tot ARCVM, run 'mkdir /var/run/arc/arcvm && mount -t 9p -o "trans=virtio,version=9p2000.L,cache=none,access=any" host_generated /var/run/arc/arcvm && ls /var/run/arc/arcvm', verify ls prints files. Change-Id: I8f8b265fc8a7de159508afbee5114b6a3f084d01 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1995319 Tested-by: Yusuke Sato <yusukes@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Lepton Wu <lepton@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Yusuke Sato <yusukes@chromium.org>
2020-01-11 00:01:11 +00:00
openat: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
@include /usr/share/policy/crosvm/common_device.policy
pread64: 1
pwrite64: 1
statx: 1
fstat: 1
ioctl: arg1 == FIOCLEX
getdents64: 1
fdatasync: 1
fsync: 1
mkdirat: 1
renameat: 1
linkat: 1
unlinkat: 1
socket: arg0 == AF_UNIX
utimensat: 1
ftruncate: 1
seccomp: 9p: Allow fchown and fchmod Needed by upcoming implementation changes. BUG=chromium:1082345,chromium:920262,chromium:912599 TEST=`emerge-$BOARD crosvm` Change-Id: Id366cd9d0bb3af24e2445fdf897d6ef45ae88115 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2784163 Auto-Submit: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-24 09:33:03 +00:00
fchmod: 1
p9: use *at() functions for set_attr Use fchmodat(), fchownat(), and utimensat() to implement the SET_ATTR request rather than using the non-'at' variants of these functions. These can operate on a file descriptor path using the /proc file handle and "self/fd/N" filename to modify the attributes of a file without actually opening it, which means we can avoid problems like not being able to open a read-only file with O_RDWR, which happened previously with chmod requests. This means we don't need to open the file at all, except in the case of a request that needs to set the size, since there is no equivalent truncateat() function. BUG=chromium:1369647 TEST=touch /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod -w /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod +w /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod a-r /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod a+r /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chown $USER /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=truncate -s1 /mnt/chromeos/MyFiles/Downloads/hello.txt Change-Id: I0461ed231cc78b26bcc37ede1a364af984c87f8b Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3935537 Reviewed-by: Alexandre Courbot <acourbot@chromium.org> Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-10-05 23:21:43 +00:00
fchmodat: 1
seccomp: 9p: Allow fchown and fchmod Needed by upcoming implementation changes. BUG=chromium:1082345,chromium:920262,chromium:912599 TEST=`emerge-$BOARD crosvm` Change-Id: Id366cd9d0bb3af24e2445fdf897d6ef45ae88115 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2784163 Auto-Submit: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-24 09:33:03 +00:00
fchown: 1
p9: use *at() functions for set_attr Use fchmodat(), fchownat(), and utimensat() to implement the SET_ATTR request rather than using the non-'at' variants of these functions. These can operate on a file descriptor path using the /proc file handle and "self/fd/N" filename to modify the attributes of a file without actually opening it, which means we can avoid problems like not being able to open a read-only file with O_RDWR, which happened previously with chmod requests. This means we don't need to open the file at all, except in the case of a request that needs to set the size, since there is no equivalent truncateat() function. BUG=chromium:1369647 TEST=touch /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod -w /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod +w /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod a-r /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chmod a+r /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=chown $USER /mnt/chromeos/MyFiles/Downloads/hello.txt TEST=truncate -s1 /mnt/chromeos/MyFiles/Downloads/hello.txt Change-Id: I0461ed231cc78b26bcc37ede1a364af984c87f8b Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3935537 Reviewed-by: Alexandre Courbot <acourbot@chromium.org> Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-10-05 23:21:43 +00:00
fchownat: 1
devices: p9: Update for API change The p9 crate API changed so that the new() function now returns a result. Update the caller to match. Additionally, the implementation also changed to use different syscalls so update the seccomp filters to match. BUG=b:162388795 TEST=Start a vm with a 9p mount and test the changed operations to make sure they still work. Cq-Depend: chromium:2494169 Change-Id: I7c4e1fd2fb192206402e895b09e519c3e769ae3c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2494328 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Chirantan Ekbote <chirantan@chromium.org>
2020-10-23 09:44:50 +00:00
fstatfs: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
newfstatat: 1
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-19 19:59:38 +00:00
prctl: arg0 == PR_SET_NAME
Reference in a new issue Copy permalink