crosvm/seccomp/x86_64/vhost_user.policy

13 lines
534 B
Text
Raw Normal View History

# Copyright 2022 The ChromiumOS Authors
crosvm: add "devices" command Add a new `devices` command to start one or several jailed vhost-user devices. `devices` improves upon `device` in the following ways: * Several devices can be created in one command, * Devices can be configured with the same arguments as the `run` command, * The created devices are jailed similarly to the `run` command. This CL does not enable any device to be started yet, it only does the plumbing to allow it. Follow-up CLs will start adding devices to this command. With the following CL, the serial device can be tested as follows: $ ./crosvm devices --serial hardware=virtio-console,console,stdin,type=stdout,earlycon,vhost=/tmp/vu-serial The parameters of the `serial` argument are the same as with `crosvm run`, with the exception that the `vhost` parameter needs to be provided to inform where the listener should await its front-end connection. `vhost` can either take a PCI device address, in which case VVU will be used, or a socket path for regular vhost-user. Using the example above, a VMM can connect to /tmp/vu-serial and use it as a console device. BUG=b:218223240 TEST=./crosvm devices --serial hardware=virtio-console,console,stdin,type=stdout,earlycon,vhost=/tmp/vu-serial gives us a working vhost-user serial device. TEST=Same command as above ran inside a VVU device VM with vhost=<PCI address of VVU device> gives us a working VVU serial device. Change-Id: I07d17dca2d02bd180b1667810ef92516ee026839 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3762974 Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: Alexandre Courbot <acourbot@chromium.org> Commit-Queue: Alexandre Courbot <acourbot@chromium.org>
2022-06-27 08:29:21 +00:00
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Policy file for the vhost-user transport over a socket.
# FIONBIO: for setting non-blocking mode over the socket.
# TCGETS/TCSETS: used on FD 0, probably for serial.
# b/239779171: try moving this to the serial device once we can extend ioctls across policy files.
ioctl: arg1 == FIONBIO || arg1 == TCGETS || arg1 == TCSETS
# For accepting a client connection over the socket.
accept4: 1