crosvm/seccomp/x86_64/gpu_device.policy

# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

@include /usr/share/policy/crosvm/gpu_common.policy

socket: arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC && arg2 == 0
clone: arg0 & CLONE_THREAD
gpu: add sandboxing via minijail for virtio gpu device. Sandboxing only works when started as chronos via concierge client. If started directly via crosvm as root, the jail will not have proper group permissions to access the Wayland socket. BUG=chromium:837073 TEST=build with --features=gpu; null_platform_test without --disable-sandbox CQ-DEPEND=CL:1213779 Change-Id: I6331f7ae1f5b99d31ad44cf158f72337294771f0 Reviewed-on: https://chromium-review.googlesource.com/1181168 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org> 2018-08-20 15:11:42 +00:00			`# Copyright 2018 The Chromium OS Authors. All rights reserved.`
			`# Use of this source code is governed by a BSD-style license that can be`
			`# found in the LICENSE file.`

seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com> 2021-12-01 21:25:41 +00:00			`@include /usr/share/policy/crosvm/gpu_common.policy`
Allow perfetto tracing from crosvm gpu process New syscalls and /run/perfetto bind mount are required. BUG=b:174162684 TEST=Run crosvm with perfetto instrumentation and confirm that events can be traced through traced. Tested on both hatch and ARM kukui device. Cq-Depend: chromium:2570487 Change-Id: I809400ec393c2971ba9a1134ddbef7f48d818786 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2571659 Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: David Riley <davidriley@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: John Bates <jbates@chromium.org> Commit-Queue: John Bates <jbates@chromium.org> 2020-12-03 19:37:33 +00:00
gpu: allow syslog from the render server BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: I6fe2ce831eb671fedd1c0aa749066c41d181d152 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3335301 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Commit-Queue: Chia-I Wu <olv@google.com> 2021-12-13 20:10:22 +00:00			`socket: arg0 == AF_UNIX && arg1 == SOCK_STREAM\|SOCK_CLOEXEC && arg2 == 0`
seccomp: add gpu_common.policy Let gpu_device.policy include gpu_common.policy. No functional change. BUG=b:177267762 TEST=run vk and gl apps on volteer Change-Id: Ic83c29b5713c95374562ee6eba35002142e00357 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3311904 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chia-I Wu <olv@google.com> 2021-12-01 21:25:41 +00:00			`clone: arg0 & CLONE_THREAD`