crosvm/seccomp/aarch64/net_device.policy

# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

@include /usr/share/policy/crosvm/common_device.policy

# TUNSETOFFLOAD
ioctl: arg1 == 0x400454d0
openat: return ENOENT

prctl: arg0 == PR_SET_NAME
seccomp: Add initial arm64 seccomp filters BUG=chromium:1029666 TEST=tast run crostini.LaunchTerminal.download_buster Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765 Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Stephen Barber <smbarber@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org> 2019-12-02 18:28:28 +00:00			`# Copyright 2019 The Chromium OS Authors. All rights reserved.`
			`# Use of this source code is governed by a BSD-style license that can be`
			`# found in the LICENSE file.`

			`@include /usr/share/policy/crosvm/common_device.policy`
devices: net: add control queue for enabling/disabling offloads Add a control queue for virtio_net, and implement the command to set available networking offloads. Set offloads initially when acking features from the guest. We previously set offloads on unconditionally. Add TUNSETOFFLOAD to the allowed ioctls for virtio_net. BUG=chromium:1031413 TEST=boot 5.4 guest, check vmtap offloads enabled with ethtool TEST=enable ip_forward in guest, check vmtap offloads disabled with ethtool Change-Id: I4129aa03419798906bd95cf65a6a4ab63069f50b Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1968200 Reviewed-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> 2019-12-14 00:49:44 +00:00
			`# TUNSETOFFLOAD`
			`ioctl: arg1 == 0x400454d0`
seccomp: remove redundant unconditional arm/arm64 rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: Ic43d1fd13f9c012641d71e526942229eb8b08ed4 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2034024 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> 2020-02-01 01:29:45 +00:00			`openat: return ENOENT`
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> 2021-04-19 19:59:38 +00:00
			`prctl: arg0 == PR_SET_NAME`