mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/x86_64/wl_device.policy

22 lines
744 B
Text
Raw Normal View History

virtwl: implement dmabuf sync support This provides proper synchronization for guest access to DMABufs. Virtio wayland device is given access to the DMA_BUF_SYNC ioctl in order to implement this. Being able to use this directly in the virtio wayland device process is important as these calls can sometimes be relatively expensive and they are frequent enough that avoiding another context switch is useful for good performance. TEST=cache-line artifacts no longer noticeable BUG=chromium:837209 Change-Id: Ibb8d7c01f70ed5b74afd69288015a65186fec52a Reviewed-on: https://chromium-review.googlesource.com/1076928 Commit-Ready: David Reveman <reveman@chromium.org> Tested-by: David Reveman <reveman@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-23 10:41:30 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
seccomp: refactor policy into common_device.policy CQ-DEPEND=CL:1449895 BUG=None TEST=vmc start termina Change-Id: Ia3edaafc1d2958bd40e6b1adc89dd5e29b679b06 Reviewed-on: https://chromium-review.googlesource.com/1448292 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2019-02-01 00:55:59 +00:00
@include /usr/share/policy/crosvm/common_device.policy
crosvm: add virtio wayland device This adds the virtio wayland device which is activated by default. The wayland device needs the XDG_RUNTIME_DIR env variable to be set and a running wayland compositor to connect to in that directory. TEST=crosvm run <other args> BUG=chromium:738638 Change-Id: Iaa417c6bb74739896042318451b4befcac0c1d0e Reviewed-on: https://chromium-review.googlesource.com/559860 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2017-06-30 22:46:14 +00:00
# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
virtwl: implement dmabuf sync support This provides proper synchronization for guest access to DMABufs. Virtio wayland device is given access to the DMA_BUF_SYNC ioctl in order to implement this. Being able to use this directly in the virtio wayland device process is important as these calls can sometimes be relatively expensive and they are frequent enough that avoiding another context switch is useful for good performance. TEST=cache-line artifacts no longer noticeable BUG=chromium:837209 Change-Id: Ibb8d7c01f70ed5b74afd69288015a65186fec52a Reviewed-on: https://chromium-review.googlesource.com/1076928 Commit-Ready: David Reveman <reveman@chromium.org> Tested-by: David Reveman <reveman@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-05-23 10:41:30 +00:00
# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC
ioctl: arg1 == 0x5421 || arg1 == 0x40086200
seccomp: whitelist connect for wl_device The path to the wayland socket changed, so the previous whitelist based on the connect() arg2 sockaddr_un size now fails. BUG=None TEST=Verify that release build of crosvm starts again on chromebook Change-Id: I3c30977e7c1487b937d69e1dbce4b7fd87136978 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/1234827 Reviewed-by: David Riley <davidriley@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-09-19 22:36:22 +00:00
connect: 1
wl: fix seccomp filter for memfd_create The memfd_create flags changed with "add memfd seal support", which breaks the seccomp filter for the wayland device. TEST=run a wayland app in crosvm BUG=chromium:799523 Change-Id: I266e305bc3179a7b9fd105a684de92e944fe1fc6 Reviewed-on: https://chromium-review.googlesource.com/852937 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-01-06 03:59:54 +00:00
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
memfd_create: arg1 == 3
crosvm: add virtio wayland device This adds the virtio wayland device which is activated by default. The wayland device needs the XDG_RUNTIME_DIR env variable to be set and a running wayland compositor to connect to in that directory. TEST=crosvm run <other args> BUG=chromium:738638 Change-Id: Iaa417c6bb74739896042318451b4befcac0c1d0e Reviewed-on: https://chromium-review.googlesource.com/559860 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2017-06-30 22:46:14 +00:00
# Used to set of size new memfd
ftruncate: 1
# Used to determine shm size after recvmsg with fd
lseek: 1
wl: add pipe vfd support Pipe VFDs are used to send and recieve data offer bytes, often used for copy/paste and drag/drop operations. TEST=use copy/paste with wayland app BUG=chromium:793688 Change-Id: Ifc3f231dcdf90ce6791a98039405c7c404cf6942 Reviewed-on: https://chromium-review.googlesource.com/983037 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-03-27 18:09:29 +00:00
# Allow F_GETFL only
fcntl: arg1 == 3
seccomp: remove redundant unconditional rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. I don't know what to do about the intentionally contradictory rules for open and openat, other than to remove then from the common device policy and add it to all the others. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: I6813dd1e0b39e975415662bd7de74c25a1be9eb3 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1918607 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2019-11-15 01:48:44 +00:00
open: return ENOENT
openat: return ENOENT
Reference in a new issue Copy permalink