mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 02:25:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/x86_64/video_device.policy

44 lines
1 KiB
Text
Raw Normal View History

devices: virtio: Initial implementation of virtio-video device This CL adds a fundamental part of the virtio video device, which will be shared between the encoder and the decoder. Both devices uses the virtio-video protocol proposed as RFC v3 [1,2]. The corresponding driver code is at CL:2060327 and its children CLs. The actual decoding and encoding logic will be implemented in different CLs. [1]: mail: https://markmail.org/thread/wxdne5re7aaugbjg [2]: PDF: https://drive.google.com/file/d/1jOsS2WdVhL4PpcWLO8Zukq5J0fXDiWn-/view BUG=b:147465619, b:140082257 TEST=cargo check --features=video-decoder,video-encoder TEST=ARCVM started with --video-decoder --video-encoder Cq-Depend: chromium:2203997 Change-Id: I01999eea218ba0f3aaed1558ca2311a57d0c6819 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1973973 Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2019-12-06 13:24:40 +00:00
# Copyright 2020 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
@include /usr/share/policy/crosvm/common_device.policy
# Syscalls specific to video devices.
clock_getres: 1
connect: 1
getdents: 1
add getdents64 to policies glibc 2.32 is using getdents64 syscall instead of getdents. So add getdents64 to policies that already have getdents. BUG=chromium:1171287 TEST=CQ Change-Id: Icbe1da7cbf669432c8160779a9cbfdeb04db57c0 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2760299 Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-03-15 17:35:07 +00:00
getdents64: 1
devices: virtio: Initial implementation of virtio-video device This CL adds a fundamental part of the virtio video device, which will be shared between the encoder and the decoder. Both devices uses the virtio-video protocol proposed as RFC v3 [1,2]. The corresponding driver code is at CL:2060327 and its children CLs. The actual decoding and encoding logic will be implemented in different CLs. [1]: mail: https://markmail.org/thread/wxdne5re7aaugbjg [2]: PDF: https://drive.google.com/file/d/1jOsS2WdVhL4PpcWLO8Zukq5J0fXDiWn-/view BUG=b:147465619, b:140082257 TEST=cargo check --features=video-decoder,video-encoder TEST=ARCVM started with --video-decoder --video-encoder Cq-Depend: chromium:2203997 Change-Id: I01999eea218ba0f3aaed1558ca2311a57d0c6819 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1973973 Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2019-12-06 13:24:40 +00:00
getegid: 1
geteuid: 1
getgid: 1
getresgid: 1
getresuid: 1
getsockname: 1
getuid: 1
# ioctl: arg1 == DRM_IOCTL_*
ioctl: arg1 & 0x6400
crosvm: add memfd_create to seccomp policy files To enable SupportsChannelUpgrade in libchrome (upstream r850346, crrev.com/c/2670092). BUG=b:189403036 TEST=tast run $hatch-DUT arc.Notification.vm arc.CheckAndroidVersion.vm arc.RemovableMedia.vm arc.Gamepad.vm arc.IMEBlockingVK.vm security.SELinuxFilesDataDir.vm arc.StartStop.vm arc.CPUSet.vm arc.Optin.vm arc.IntentForward.vm arc.MIDIClient.vm arc.IMESwitchShortcut.vm arc.ChromeCrash.vm_logged_in arc.Boot.vm arc.BuildProperties.vm arc.ConciergeCrash arc.VMPstoreDump security.SELinuxProcessesARC.vm security.NetworkListenersARC.vm with disable patch removed in libchrome Change-Id: I1a924c60ebe9707627fdd064b2233a7452d5cc57 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2984719 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Qijiang Fan <fqj@google.com> Commit-Queue: Grace Cham <hscham@chromium.org>
2021-06-24 05:08:28 +00:00
memfd_create: 1
devices: virtio: Initial implementation of virtio-video device This CL adds a fundamental part of the virtio video device, which will be shared between the encoder and the decoder. Both devices uses the virtio-video protocol proposed as RFC v3 [1,2]. The corresponding driver code is at CL:2060327 and its children CLs. The actual decoding and encoding logic will be implemented in different CLs. [1]: mail: https://markmail.org/thread/wxdne5re7aaugbjg [2]: PDF: https://drive.google.com/file/d/1jOsS2WdVhL4PpcWLO8Zukq5J0fXDiWn-/view BUG=b:147465619, b:140082257 TEST=cargo check --features=video-decoder,video-encoder TEST=ARCVM started with --video-decoder --video-encoder Cq-Depend: chromium:2203997 Change-Id: I01999eea218ba0f3aaed1558ca2311a57d0c6819 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1973973 Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2019-12-06 13:24:40 +00:00
openat: 1
secomp: Allow sched_yield for video device. libvda depends on libchrome and libchrome call sched_yield in NeedsLazyInstance sometimes. BUG=b:159855961 TEST=manual - keep running `android -c reboot` on hatch-arc-r Change-Id: I39afb77541c6d129ff84a776644c5cb68687ec82 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2269339 Commit-Queue: Lepton Wu <lepton@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Alexandre Courbot <acourbot@chromium.org> Tested-by: Lepton Wu <lepton@chromium.org> Auto-Submit: Lepton Wu <lepton@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Alexandre Courbot <acourbot@chromium.org>
2020-06-26 03:24:29 +00:00
sched_yield: 1
devices: virtio: Initial implementation of virtio-video device This CL adds a fundamental part of the virtio video device, which will be shared between the encoder and the decoder. Both devices uses the virtio-video protocol proposed as RFC v3 [1,2]. The corresponding driver code is at CL:2060327 and its children CLs. The actual decoding and encoding logic will be implemented in different CLs. [1]: mail: https://markmail.org/thread/wxdne5re7aaugbjg [2]: PDF: https://drive.google.com/file/d/1jOsS2WdVhL4PpcWLO8Zukq5J0fXDiWn-/view BUG=b:147465619, b:140082257 TEST=cargo check --features=video-decoder,video-encoder TEST=ARCVM started with --video-decoder --video-encoder Cq-Depend: chromium:2203997 Change-Id: I01999eea218ba0f3aaed1558ca2311a57d0c6819 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1973973 Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2019-12-06 13:24:40 +00:00
setpriority: 1
socket: arg0 == AF_UNIX
stat: 1
seccomp: x86_64: Allow fstat for video device libvda depends minigbm, on amdgpu, minigbm calls dri_init to check GPU type. dri_init calls drmGetRenderDeviceNameFromFd in libdrm which calls fstat. BUG=b:161376212 TEST=manual - Run arcvm on grunt Change-Id: I3dcb723711030d25e85cf3cac4cc7c66e0e2077f Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2301439 Commit-Queue: Lepton Wu <lepton@chromium.org> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Tested-by: Lepton Wu <lepton@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Lepton Wu <lepton@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2020-07-16 06:20:54 +00:00
fstat: 1
seccomp: Update seccomp filters for glibc At present, libraries which use glibc to dynamically load shared libraries do not have fstafs in their seccomp policies. A change in glibc will force all systems which load shared libraries to call the fstatfs or fstatfs64 syscall. Without the call, crosvm will not start when running crostini/android tests. BUG=chromium:1182687 TEST=CQ of https://crrev.com/c/2910526 Change-Id: I10abb8866474c2fe0398a17a80069cf2b0629493 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3011355 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dennis Kempin <denniskempin@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Jordan R Abrahams <ajordanr@google.com>
2021-07-08 02:02:59 +00:00
fstatfs: 1
Expand video sandboxing for AMD devices BUG=b:170062417 TEST=tast run grunt-DUT arc.Boot.vm and no resource bridge logspam Change-Id: I84e185c4507b8df6b09505a369f09933d3d6143f Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2461149 Reviewed-by: Alexandre Courbot <acourbot@chromium.org> Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: David Stevens <stevensd@chromium.org> Commit-Queue: David Stevens <stevensd@chromium.org>
2020-10-08 09:02:32 +00:00
# Rules needed for minigbm on AMD devices.
getrandom: 1
lstat: 1
# mmap/mprotect differ from the common_device.policy
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
readlink: 1
sched_setaffinity: 1
seccomp: x86_64: Fix video device crash on AMD GPU BUG=b:174620502 TEST=`tast run $DUT arc.Boot.vm` Change-Id: I62e61aa681353d88c3cf8f69ce0f97db3e919599 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2570453 Tested-by: Lepton Wu <lepton@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Lepton Wu <lepton@chromium.org> Reviewed-by: Morg <morg@chromium.org> Commit-Queue: Morg <morg@chromium.org>
2020-12-03 01:32:59 +00:00
sched_setscheduler: arg1 == SCHED_IDLE || arg1 == SCHED_BATCH
# Required by mesa on AMD GPU
sysinfo: 1
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-19 19:59:38 +00:00
prctl: arg0 == PR_SET_NAME
Reference in a new issue Copy permalink