mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/aarch64/common_device.policy

49 lines
822 B
Text
Raw Normal View History

seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
brk: 1
clone: arg0 & CLONE_THREAD
close: 1
dup3: 1
dup: 1
epoll_create1: 1
epoll_ctl: 1
epoll_pwait: 1
eventfd2: 1
exit: 1
exit_group: 1
futex: 1
getpid: 1
gettimeofday: 1
devices: Use async from balloon The newly added async primitives allow for increasing the separation of the various tasks performed by balloon. Breaking each task in to an asynchronous function. BUG=chromium:901139 TEST=Boot crosvm, run 'crosvm balloon' to set the balloon size, check 'vmstat' inside the VM to verify the free memory is affected by the balloon growing and shrinking. run crosvm balloon_stats command and ensure that stats are reported correctly. Change-Id: I0ae2be5eb8e4be65b2eb74de90888357af6ecfd4 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1993163 Tested-by: Keiichi Watanabe <keiichiw@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2020-01-09 07:14:08 +00:00
io_uring_setup: 1
io_uring_enter: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
kill: 1
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
mmap: arg2 in ~PROT_EXEC
mprotect: arg2 in ~PROT_EXEC
mremap: 1
munmap: 1
nanosleep: 1
tree-wide: seccomp: allow clock_nanosleep syscalls Starting with 2.32 glibc nanosleep() was refactored to use the clock_nanosleep syscall so various software will fail unless the new syscall is allowed. We can't just drop the old nanosleep syscall because it will break glibc 2.27 which is still used. See glibc commits: 807edded25 nptl: Refactor thrd_sleep in terms of clock_nanosleep 3537ecb49c Refactor nanosleep in terms of clock_nanosleep 79a547b162 nptl: Move nanosleep implementation to libc This is a bulk edit done with the following command: git grep -rl 'nanosleep: 1' | xargs sed -i \ '/^nanosleep: 1/a clock_nanosleep: 1' BUG=chromium:1171287 TEST=Local builds and booting on kevin/64/eve/minnie. Change-Id: I975535078d88200f52319c7eea3a4c7ebf299933 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2735575 Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-04 13:29:55 +00:00
clock_nanosleep: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
pipe2: 1
ppoll: 1
read: 1
readv: 1
recvfrom: 1
recvmsg: 1
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
rt_sigreturn: 1
sched_getaffinity: 1
Allow sched_yield in all devices' seccomp policy The sched_yield system call is somehow called by the code the rust compiler generates and not directly by the author's implementation. That along with the fact that it won't get called on every run makes it very easy to miss when adding a new device (that happened with virtio-snd). Since that call is quite harmless (it could be argued minijail shouldn't even block it in the first place) it makes sense to allow it for all devices. BUG=b/201306350 Change-Id: I9895da6c8060ae83053474ed9e4472ea2cd8d3e3 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3248126 Auto-Submit: Jorge Moreira Broche <jemoreira@google.com> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-10-27 17:50:22 +00:00
sched_yield: 1
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org>
2019-12-02 18:28:28 +00:00
sendmsg: 1
sendto: 1
set_robust_list: 1
sigaltstack: 1
write: 1
writev: 1
Replace dup with fcntl(F_DUPFD_CLOEXEC) Fds created via dup don't share file descriptor flags with the original fd, which means that they don't have the FD_CLOEXEC flag set. Use fcntl(F_DUPFD_CLOEXEC) so that this flag gets set for the duplicated fds as well. BUG=none TEST=unit tests Change-Id: Ib471cf40acac1eacf72969ba45247f50b349ed58 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2809687 Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2021-04-07 08:40:57 +00:00
fcntl: 1
cros_async: Don't use io_uring on kernels < 5.10 Kernels before 5.10 had known bugs in the io_uring implementation. Don't use io_uring when we detect this. Also skip all the io_uring tests in this case. BUG=none TEST=cargo test Change-Id: I5fd6203ad25a6fb85ff28f1a6ddb0181f836ad89 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3006309 Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org> Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org> Reviewed-by: Woody Chow <woodychow@google.com>
2021-07-06 07:35:07 +00:00
uname: 1
Reference in a new issue Copy permalink