crosvm/seccomp/x86_64/rng_device.policy

# Copyright 2017 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

@include /usr/share/policy/crosvm/common_device.policy

getrandom: 1
open: return ENOENT
openat: return ENOENT
prctl: arg0 == PR_SET_NAME
Put seccomp policy files in a common directory We will almost certainly require different seccomp policy files for different architectures. Move all the existing secommp policy files into a common directory grouped by architecture. This will make it easier to install them via the ebuild later. BUG=none TEST=none Change-Id: I0495789cd4143dc374ee6ebe083dc20ce724edbb Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/630058 Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> 2017-08-23 18:20:36 +00:00			`# Copyright 2017 The Chromium OS Authors. All rights reserved.`
			`# Use of this source code is governed by a BSD-style license that can be`
			`# found in the LICENSE file.`

seccomp: refactor policy into common_device.policy CQ-DEPEND=CL:1449895 BUG=None TEST=vmc start termina Change-Id: Ia3edaafc1d2958bd40e6b1adc89dd5e29b679b06 Reviewed-on: https://chromium-review.googlesource.com/1448292 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> 2019-02-01 00:55:59 +00:00			`@include /usr/share/policy/crosvm/common_device.policy`
seccomp: remove redundant unconditional rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. I don't know what to do about the intentionally contradictory rules for open and openat, other than to remove then from the common device policy and add it to all the others. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: I6813dd1e0b39e975415662bd7de74c25a1be9eb3 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1918607 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> 2019-11-15 01:48:44 +00:00
devices: Update rng devices to be platform agnostic On Unix, instead of getting random data from `/dev/urandom`, it will get it from the `rand` platform agnostic crate instead. OsRng.fill_bytes on unix will make a syscall to getrandom(2) if available, otherwise it will read from `dev/urandom` after a succesful poll to `dev/random`. Regardless of which way a random data is retrieved, if the entropy pool is not intialized, `fill_bytes` will block until it is intialized. This shouldn't be a problem because it is a one time cost. This CL will also upstream the Windows implementation of the rng device. BUG=b:213149162 TEST=built and presubmits Change-Id: Ic017f11795f8006e0bf2a04eb0478b3a3d336507 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3657812 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Richard Zhang <rizhang@google.com> 2022-05-19 19:07:44 +00:00			`getrandom: 1`
seccomp: remove redundant unconditional rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. I don't know what to do about the intentionally contradictory rules for open and openat, other than to remove then from the common device policy and add it to all the others. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: I6813dd1e0b39e975415662bd7de74c25a1be9eb3 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1918607 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> 2019-11-15 01:48:44 +00:00			`open: return ENOENT`
			`openat: return ENOENT`
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> 2021-04-19 19:59:38 +00:00			`prctl: arg0 == PR_SET_NAME`