mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-12-26 21:38:25 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/wl_device.policy

54 lines
1.3 KiB
Text
Raw Normal View History

crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
close: 1
dup: 1
dup2: 1
getpid: 1
crosvm: aarch64: whitelist gettimeofday for error messages It looks like on ARM we use the real gettimeofday system call when we're outputting error messages, so we need to whitelist this to avoid crashing instead of seeing the error messages. BUG=chromium:843807 TEST=run vm_CrosVmStart and make sure there are no crashes for crosvm Change-Id: I9f47da8dabe31f0677bcaa1d431e56545e20c9c9 Reviewed-on: https://chromium-review.googlesource.com/1081390 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-06-01 00:35:02 +00:00
gettimeofday: 1
crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
exit_group: 1
futex: 1
# Disallow mmap with PROT_EXEC set. The syntax here doesn't allow bit
# negation, thus the manually negated mask constant.
mmap2: arg2 in 0xfffffffb
mprotect: arg2 in 0xfffffffb
# Allow MADV_DONTDUMP only.
madvise: arg2 == 0x00000010
munmap: 1
poll: 1
ppoll: 1
read: 1
recv: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
# arg0 is flags. Because kernel.
clone: arg0 & 0x00010000
write: 1
eventfd2: 1
# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
virtwl: implement dmabuf sync support This provides proper synchronization for guest access to DMABufs. Virtio wayland device is given access to the DMA_BUF_SYNC ioctl in order to implement this. Being able to use this directly in the virtio wayland device process is important as these calls can sometimes be relatively expensive and they are frequent enough that avoiding another context switch is useful for good performance. TEST=cache-line artifacts no longer noticeable BUG=chromium:837209 Change-Id: Ibb8d7c01f70ed5b74afd69288015a65186fec52a Reviewed-on: https://chromium-review.googlesource.com/1076928 Commit-Ready: David Reveman <reveman@chromium.org> Tested-by: David Reveman <reveman@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-23 10:41:30 +00:00
# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC
ioctl: arg1 == 0x5421 || arg1 == 0x40086200
crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
connect: arg2 == 13
# Used to communicate with wayland
recvmsg: 1
sendmsg: 1
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
memfd_create: arg1 == 3
# Used to set of size new memfd
crosvm: aarch64: fix truncate on wayland policy Like block_device, also needs to use ftruncate64 instead of ftruncate. BUG=chromium:840048 TEST=manual test of graphics on kevin Change-Id: Ib24b12fd681c96ecc2fec796fe480e94a96a0626 Reviewed-on: https://chromium-review.googlesource.com/1050916 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-09 02:05:28 +00:00
ftruncate64: 1
crosvm: aarch64: add seccomp policy for wl_wayland Add a seccomp policy for virtio wayland devices on aarch64. BUG=chromium:797868 TEST=./build_test passes on all architectures TEST=crosvm runs on kevin built with USE="kvm_host" with a wayland socket passed in Change-Id: I89e9904b48598d78be0721ba8b3242d1b43f7aa3 Reviewed-on: https://chromium-review.googlesource.com/999169 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-04-05 23:25:34 +00:00
# Used to determine shm size after recvmsg with fd
_llseek: 1
# Allow PR_SET_NAME only.
prctl: arg0 == 15
restart_syscall: 1
wl: add pipe2 and fcntl64 to wl_device.policy These syscalls were added to the x86 policy when vfd pipe support was added, but they were never added to the arm version, for whatever reason. This is needed to keep crosvm from getting killed by SIGSYS whenver the user copies to or from guest applications. BUG=chromium:864218 TEST=on kevin, copy/paste to/from gedit Change-Id: Ibe385d50e367c362e911badd640bab2c98e07030 Reviewed-on: https://chromium-review.googlesource.com/1145876 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-07-20 23:47:21 +00:00
# Allow F_GETFL only
fcntl64: arg1 == 3
pipe2: 1
crosvm: aarch64: add epoll syscalls to seccomp policy for wayland Match the configuration for x86_64 BUG=chromium:816692 TEST=run wayland under crosvm on kevin Change-Id: If21bccddba362656fc02b213b9f30166f2c4be13 Reviewed-on: https://chromium-review.googlesource.com/1006488 Commit-Ready: Sonny Rao <sonnyrao@chromium.org> Tested-by: Sonny Rao <sonnyrao@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-04-11 03:40:13 +00:00
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
Reference in a new issue Copy permalink