mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-06 02:25:23 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions

seccomp: x86_64: inline common_device syscalls into video_device

Browse source 
The video device needs to redefine the filters for mmap and mprotect,
which the minijail compiler rejects:

    compile_file: /usr/share/policy/crosvm/video_device.policy(35): syscall mmap redefined here
    compile_file: /usr/share/policy/crosvm/common_device.policy(26): previous definition here
    compile_file: /usr/share/policy/crosvm/video_device.policy(36): syscall mprotect redefined here
    compile_file: /usr/share/policy/crosvm/common_device.policy(27): previous definition here
    compile_filter: compile_file() failed
    failed to compile seccomp filter BPF program in '/usr/share/policy/crosvm/video_device.policy'

Prevent this error from happening by inlining the common_device
declarations in video_device and removing the declarations for mmap and
mprotect.

BUG=b:210601086
TEST=Video device can be created when making crosvm use the .policy
files instead of compiled .bpfs.

Change-Id: Ifa7aa84772ae59123cc04e8c9ea845ba6ed7b559
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3341131
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Alexandre Courbot <acourbot@chromium.org>
This commit is contained in:
Alexandre Courbot 2021-12-15 16:52:43 +09:00 committed by Commit Bot
parent 1e6e7b2ee9
commit cd88647f7d
1 changed files with 49 additions and 1 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

50
seccomp/x86_64/video_device.policy
View file

@ -2,7 +2,55 @@
# Use of this source code is governed by a BSD-style license that can be # Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file. # found in the LICENSE file.
@include /usr/share/policy/crosvm/common_device.policy # Rules from common_device.policy with mmap and mprotect removed because the video device needs
# to allow more arguments for them.
brk: 1
clone: arg0 & CLONE_THREAD
close: 1
dup2: 1
dup: 1
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
eventfd2: 1
exit: 1
exit_group: 1
futex: 1
getcwd: 1
getpid: 1
gettid: 1
gettimeofday: 1
io_uring_setup: 1
io_uring_enter: 1
kill: 1
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
mremap: 1
munmap: 1
nanosleep: 1
clock_nanosleep: 1
pipe2: 1
poll: 1
ppoll: 1
read: 1
readlink: 1
readlinkat: 1
readv: 1
recvfrom: 1
recvmsg: 1
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
rt_sigreturn: 1
sched_getaffinity: 1
sched_yield: 1
sendmsg: 1
sendto: 1
set_robust_list: 1
sigaltstack: 1
write: 1
writev: 1
fcntl: 1
uname: 1
# Syscalls specific to video devices. # Syscalls specific to video devices.
clock_getres: 1 clock_getres: 1