From cd88647f7dc6267c6735aca7847a6675bcdbbbef Mon Sep 17 00:00:00 2001 From: Alexandre Courbot Date: Wed, 15 Dec 2021 16:52:43 +0900 Subject: [PATCH] seccomp: x86_64: inline common_device syscalls into video_device The video device needs to redefine the filters for mmap and mprotect, which the minijail compiler rejects: compile_file: /usr/share/policy/crosvm/video_device.policy(35): syscall mmap redefined here compile_file: /usr/share/policy/crosvm/common_device.policy(26): previous definition here compile_file: /usr/share/policy/crosvm/video_device.policy(36): syscall mprotect redefined here compile_file: /usr/share/policy/crosvm/common_device.policy(27): previous definition here compile_filter: compile_file() failed failed to compile seccomp filter BPF program in '/usr/share/policy/crosvm/video_device.policy' Prevent this error from happening by inlining the common_device declarations in video_device and removing the declarations for mmap and mprotect. BUG=b:210601086 TEST=Video device can be created when making crosvm use the .policy files instead of compiled .bpfs. Change-Id: Ifa7aa84772ae59123cc04e8c9ea845ba6ed7b559 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3341131 Reviewed-by: Daniel Verkamp Tested-by: kokoro Commit-Queue: Alexandre Courbot --- seccomp/x86_64/video_device.policy | 50 +++++++++++++++++++++++++++++- 1 file changed, 49 insertions(+), 1 deletion(-) diff --git a/seccomp/x86_64/video_device.policy b/seccomp/x86_64/video_device.policy index 1221a2196e..de9cdf049f 100644 --- a/seccomp/x86_64/video_device.policy +++ b/seccomp/x86_64/video_device.policy @@ -2,7 +2,55 @@ # Use of this source code is governed by a BSD-style license that can be # found in the LICENSE file. -@include /usr/share/policy/crosvm/common_device.policy +# Rules from common_device.policy with mmap and mprotect removed because the video device needs +# to allow more arguments for them. +brk: 1 +clone: arg0 & CLONE_THREAD +close: 1 +dup2: 1 +dup: 1 +epoll_create1: 1 +epoll_ctl: 1 +epoll_wait: 1 +eventfd2: 1 +exit: 1 +exit_group: 1 +futex: 1 +getcwd: 1 +getpid: 1 +gettid: 1 +gettimeofday: 1 +io_uring_setup: 1 +io_uring_enter: 1 +kill: 1 +madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE +mremap: 1 +munmap: 1 +nanosleep: 1 +clock_nanosleep: 1 +pipe2: 1 +poll: 1 +ppoll: 1 +read: 1 +readlink: 1 +readlinkat: 1 +readv: 1 +recvfrom: 1 +recvmsg: 1 +restart_syscall: 1 +rt_sigaction: 1 +rt_sigprocmask: 1 +rt_sigreturn: 1 +sched_getaffinity: 1 +sched_yield: 1 +sendmsg: 1 +sendto: 1 +set_robust_list: 1 +sigaltstack: 1 +write: 1 +writev: 1 +fcntl: 1 +uname: 1 # Syscalls specific to video devices. clock_getres: 1