mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 10:32:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/xhci.policy

45 lines
1.3 KiB
Text
Raw Normal View History

implement xhci and add it to pci bus Implement xhci controller, setup seccomp filters and add xhci to pci bus. CQ-DEPEND=CL:1512761 BUG=chromium:831850 TEST=local build Change-Id: I5c05452ece66e99d3a670e259e095fca616e835d Reviewed-on: https://chromium-review.googlesource.com/1512762 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Jingkui Wang <jkwang@google.com> Reviewed-by: Jingkui Wang <jkwang@google.com>
2019-03-09 04:41:57 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
@include /usr/share/policy/crosvm/common_device.policy
stat64: 1
lstat64: 1
usb: update xhci policies to allow newer libusb The updated version of libusb uses USBFS_CONNECTINFO and USBFS_CONNINFO_EX ioctls, as well as readlink and lseek syscalls, so let's enable them. BUG=b:133773289 TEST=Try attaching a USB device to Crostini VM. Change-Id: Ibdcab2da9abe1c0bb35c989d9d62b44ce403e268 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1650534 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Dmitry Torokhov <dtor@chromium.org>
2019-06-10 23:45:32 +00:00
readlink: 1
implement xhci and add it to pci bus Implement xhci controller, setup seccomp filters and add xhci to pci bus. CQ-DEPEND=CL:1512761 BUG=chromium:831850 TEST=local build Change-Id: I5c05452ece66e99d3a670e259e095fca616e835d Reviewed-on: https://chromium-review.googlesource.com/1512762 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Jingkui Wang <jkwang@google.com> Reviewed-by: Jingkui Wang <jkwang@google.com>
2019-03-09 04:41:57 +00:00
readlinkat: 1
getdents64: 1
name_to_handle_at: 1
access: 1
timerfd_create: 1
getsockname: 1
pipe: 1
setsockopt: 1
bind: 1
socket: arg0 == AF_NETLINK
stat: 1
seccomp: allow statx syscall where stat/fstat was allowed This is used in Rust 1.40.0's libstd in place of stat/fstat; update the whitelists to allow the new syscall as well. BUG=chromium:1042461 TEST=`crosvm disk resize` does not trigger seccomp failure Change-Id: Ia3f0e49ee009547295c7af7412dfb5eb3ac1efcb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2003685 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-01-15 21:34:09 +00:00
statx: 1
implement xhci and add it to pci bus Implement xhci controller, setup seccomp filters and add xhci to pci bus. CQ-DEPEND=CL:1512761 BUG=chromium:831850 TEST=local build Change-Id: I5c05452ece66e99d3a670e259e095fca616e835d Reviewed-on: https://chromium-review.googlesource.com/1512762 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Jingkui Wang <jkwang@google.com> Reviewed-by: Jingkui Wang <jkwang@google.com>
2019-03-09 04:41:57 +00:00
uname: 1
# The following ioctls are:
# 0x4004550d == USBDEVFS_REAPURBNDELAY32
# 0x550b == USBDEVFS_DISCARDURB
# 0x8004550f == USBDEVFS_CLAIMINTERFACE
# 0x80045510 == USBDEVFS_RELEASEINTERFACE
seccomp: allow USBDEVFS_CLEAR_HALT This USB ioctl is used in usb_util::Device::clear_halt(), but it was not allowed in the seccomp policy. BUG=chromium:1167286 TEST=Attach Keyspan USA-19H USB serial adapter to Crostini Change-Id: I625cde121a0a248046e476eecd732a98530811dc Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2633824 Reviewed-by: Matthew Blecker <matthewb@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Matthew Blecker <matthewb@chromium.org> Commit-Queue: Matthew Blecker <matthewb@chromium.org>
2021-01-15 19:45:53 +00:00
# 0x80045515 == USBDEVFS_CLEAR_HALT
implement xhci and add it to pci bus Implement xhci controller, setup seccomp filters and add xhci to pci bus. CQ-DEPEND=CL:1512761 BUG=chromium:831850 TEST=local build Change-Id: I5c05452ece66e99d3a670e259e095fca616e835d Reviewed-on: https://chromium-review.googlesource.com/1512762 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Jingkui Wang <jkwang@google.com> Reviewed-by: Jingkui Wang <jkwang@google.com>
2019-03-09 04:41:57 +00:00
# 0x8004551a == USBDEVFS_GET_CAPABILITIES
# 0x802c550a == USBDEVFS_SUBMITURB
# 0xc0105500 == USBDEVFS_CONTROL
usb: fix serial devices by removing device context verification 1. Removed for device slot reset and evaluate context. The verification was unnecessary and may cause some guest kernel operations to fail. 2. The context was updated after dequeue pointer set 3. Reset device when it's attached. 4. Add seccomp rules to allow the above reset. The verification was copied from another implementation which works for adb, but does not work with serial devices. The verification is also not part of the spec, so we removed it here. BUG=b:131336977 TEST=local build and test Change-Id: Ifd7994ff5512346d1bab27654e60c97a602da8a6 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Signed-off-by: Zach Reizner <zachr@google.com> Reviewed-on: https://chromium-review.googlesource.com/1558934 Tested-by: kokoro <noreply+kokoro@google.com>
2019-03-20 18:16:26 +00:00
# 0x5514 == USBDEVFS_RESET
# 0x80045505 == USBDEVFS_SETCONFIGURATION
usb: reset backend device on port reset This enables the full firmware update/reset/use device in application mode sequence for Edge TPU USB Accelerator. There is a bit of a UI hiccup: once the firmware update and reset is complete, the device re-enumerates with a different VID/PID, and the "Connect to Linux" prompt shows up again. The user must re-affirm that the device should be connected to Linux to proceed with using the Edge TPU. This may be unavoidable - I'm not sure if we can tell the difference between a newly-inserted device and a reset one. Allowing USBDEVFS_DISCONNECT_CLAIM should be safe, since it can only operate on file descriptors passed into the xhci device jail. BUG=chromium:831850 TEST=Run Edge TPU Accelerator demo and verify that it can update FW Change-Id: I3d61c7bd914830ce25448b1ae4d60e1c16f10aed Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1599881 Reviewed-by: Zach Reizner <zachr@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>
2019-05-07 21:19:23 +00:00
# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
usb: update xhci policies to allow newer libusb The updated version of libusb uses USBFS_CONNECTINFO and USBFS_CONNINFO_EX ioctls, as well as readlink and lseek syscalls, so let's enable them. BUG=b:133773289 TEST=Try attaching a USB device to Crostini VM. Change-Id: Ibdcab2da9abe1c0bb35c989d9d62b44ce403e268 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1650534 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Dmitry Torokhov <dtor@chromium.org>
2019-06-10 23:45:32 +00:00
# 0x40085511 == USBDEVFS_CONNECTINFO
usb: update USBDEVFS_CONNINFO_EX value to new size The layout of struct usbfs_conninfo_ex was changed in the final revision of the patch, so the corresponding ioctl number needs to change to match, since the parameter size is encoded in the ioctl. The new size is 0x18 or 24, which matches the struct usbfs_conninfo_ex layout with 7 ports. BUG=chromium:977020 TEST=Attach Android device to Linux VM on nami Change-Id: Iec60b4c04880d7d2c71fdea49cfdf7fb5a75f5c6 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1669530 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Dmitry Torokhov <dtor@chromium.org> Commit-Queue: Dmitry Torokhov <dtor@chromium.org>
2019-06-20 16:21:40 +00:00
# 0x80185520 == USBDEVFS_CONNINFO_EX
seccomp: allow USBDEVFS_CLEAR_HALT This USB ioctl is used in usb_util::Device::clear_halt(), but it was not allowed in the seccomp policy. BUG=chromium:1167286 TEST=Attach Keyspan USA-19H USB serial adapter to Crostini Change-Id: I625cde121a0a248046e476eecd732a98530811dc Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2633824 Reviewed-by: Matthew Blecker <matthewb@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Matthew Blecker <matthewb@chromium.org> Commit-Queue: Matthew Blecker <matthewb@chromium.org>
2021-01-15 19:45:53 +00:00
ioctl: arg1 == 0xc0105500 || arg1 == 0x802c550a || arg1 == 0x8004551a || arg1 == 0x4004550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520
implement xhci and add it to pci bus Implement xhci controller, setup seccomp filters and add xhci to pci bus. CQ-DEPEND=CL:1512761 BUG=chromium:831850 TEST=local build Change-Id: I5c05452ece66e99d3a670e259e095fca616e835d Reviewed-on: https://chromium-review.googlesource.com/1512762 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: Jingkui Wang <jkwang@google.com> Reviewed-by: Jingkui Wang <jkwang@google.com>
2019-03-09 04:41:57 +00:00
fstat: 1
getrandom: 1
getdents: 1
usb: Arm seccomp policy needs _llseek, not lseek Since our Arm version is a 32-bit process, it uses the _llseek syscall rather than lseek for 64-bit file offset support. Fix the seccomp filter to match. Fixes a SIGSYS when attaching a USB device to Linux VM on Arm. BUG=None TEST=Attach USB device to kevin; verify device in `adb devices` Change-Id: Ia46e60df17950bfbe967c4730c62ddb26fb6faa7 Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1677318 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2019-06-25 23:15:59 +00:00
_llseek: 1
seccomp: remove redundant unconditional arm/arm64 rules Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: Ic43d1fd13f9c012641d71e526942229eb8b08ed4 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2034024 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2020-02-01 01:29:45 +00:00
open: return ENOENT
openat: 1
Specify prctl's policy only once per device The libminijail version in AOSP complains when there are multiple entries for the same system call, which was the case for virtio-fs's policy. BUG=b/185811304 Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307 Commit-Queue: Jorge Moreira Broche <jemoreira@google.com> Tested-by: Jorge Moreira Broche <jemoreira@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-19 19:59:38 +00:00
prctl: arg0 == PR_SET_NAME
Reference in a new issue Copy permalink