mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/fs_device.policy

32 lines
531 B
Text
Raw Normal View History

Enable seccomp for virtio-fs Add x86_64 and arm seccomp policy files for the virtio-fs device. BUG=b:136128319 TEST=Run a vm with a sandboxed virtio-fs device Change-Id: I8ea7c5d3e90696077f0c2b1f942cb286a0b36cf4 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1916559 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2019-11-14 09:45:56 +00:00
# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
openat: 1
@include /usr/share/policy/crosvm/common_device.policy
fchmodat: 1
fchownat: 1
fgetxattr: 1
fsetxattr: 1
fstatat64: 1
fstatfs64: 1
ftruncate64: 1
getdents64: 1
devices: fs: Use 32-bit uid/gid values on arm The setres{u,g}id and the gete{u,g}id system calls on arm use 16 bit values for uid_t and gid_t. This causes the kernel to interpret a uid/gid of 65535 as -1, which means do nothing. Use the 32-bit variants of these system calls instead so that we can use 32-bit values. Normally, libc would take care of hiding these kinds of implementation details but since we can't use the libc wrappers for these system calls, we have to do it ourselves. BUG=b:136128319 TEST=`tast run vm.Virtiofs` on kevin Change-Id: I6c0fda42c131e059139000828b3a53d4a73f340c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1923569 Tested-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2019-11-18 05:50:10 +00:00
getegid32: 1
geteuid32: 1
Enable seccomp for virtio-fs Add x86_64 and arm seccomp policy files for the virtio-fs device. BUG=b:136128319 TEST=Run a vm with a sandboxed virtio-fs device Change-Id: I8ea7c5d3e90696077f0c2b1f942cb286a0b36cf4 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1916559 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2019-11-14 09:45:56 +00:00
linkat: 1
_llseek: 1
mkdirat: 1
mknodat: 1
preadv: 1
pwritev: 1
readlinkat: 1
renameat2: 1
devices: fs: Use 32-bit uid/gid values on arm The setres{u,g}id and the gete{u,g}id system calls on arm use 16 bit values for uid_t and gid_t. This causes the kernel to interpret a uid/gid of 65535 as -1, which means do nothing. Use the 32-bit variants of these system calls instead so that we can use 32-bit values. Normally, libc would take care of hiding these kinds of implementation details but since we can't use the libc wrappers for these system calls, we have to do it ourselves. BUG=b:136128319 TEST=`tast run vm.Virtiofs` on kevin Change-Id: I6c0fda42c131e059139000828b3a53d4a73f340c Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1923569 Tested-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2019-11-18 05:50:10 +00:00
setresgid32: 1
setresuid32: 1
Enable seccomp for virtio-fs Add x86_64 and arm seccomp policy files for the virtio-fs device. BUG=b:136128319 TEST=Run a vm with a sandboxed virtio-fs device Change-Id: I8ea7c5d3e90696077f0c2b1f942cb286a0b36cf4 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1916559 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2019-11-14 09:45:56 +00:00
symlinkat: 1
umask: 1
unlinkat: 1
utimensat: 1
Reference in a new issue Copy permalink