Commit graph

164 commits

Author SHA1 Message Date
Dennis Kempin
e6ad05efc0 seccomp: Remove readlink from aarch64 policies
aarch64 only has the readlinkat syscall.

BUG=b:209021536
TEST=Cq

Change-Id: I0a6a76bbc388f598f639a97832269256f6e9a61e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3314710
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-12-03 19:35:07 +00:00
Daniel Verkamp
6a7fdb4510 seccomp: add getcwd and readlink to common policy for panic
The panic handler uses getcwd and readlink to print out the executable
name in the backtrace. Allow these for all devices so that panics
actually work instead of crashing the process.

BUG=None
TEST=intentionally panic crosvm on kevin and check /var/log/messages

Change-Id: If64a752a6f0b1f2f6bdd6663ce77078305f38171
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3309201
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-12-02 23:18:03 +00:00
Dennis Kempin
b1751f360e seccomp: Allow lseek on cras_audio_device
The syscall is used for the file backed memory region used
by the audio device since https://crrev.com/c/3159883

BUG=b:208264646
TEST=CQ

Change-Id: I02c24da6389d60847996a62ee0eab658f9c4f7cf
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3307240
Commit-Queue: Dennis Kempin <denniskempin@google.com>
Tested-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-11-29 23:28:45 +00:00
Jordan R Abrahams
ff7f1ae9fe seccomp: Add statx to video_device.policy for glibc
With the new glibc 2.33 roll, we're seeing crashes live relating to
statx (syscall 397). The process that's crashing is pcivirtio-video,
so we suspect video_device.policy is the breaking policy.

Crash report: http://shortn/_4EWpF4q77O

This was very recently fixed in arm (where the original crash occured),
however, it's still missing in the amd64/x86_64 policy file. It's
very feasible we'll see a similar case in the future with this arch.

BUG=b:187795909
TEST=CQ

Change-Id: I7b02ccf02d214590aadc37dc53e00ad34e178a4a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3291890
Auto-Submit: Jordan R Abrahams <ajordanr@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
2021-11-19 04:18:27 +00:00
Lepton Wu
fbb368a9f7 seccomp: Allow statx for video device on arm
I guess this was caused by libc uprev so the actual used
system call changed.

BUG=b:206348631
TEST=manual - Run arc.Boot.vm on kukui-arc-r with updated policy

Change-Id: Ibb8702d9ec6844624c9779088aefcdad34322d80
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3290581
Auto-Submit: Lepton Wu <lepton@chromium.org>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
2021-11-18 08:50:57 +00:00
Daniel Verkamp
f20c1cd1e8 wl: update seccomp policies for SYNC_IOC_FILE_INFO on arm
Fixes https://crrev.com/c/3199298, which only added the new ioctl
argument to the seccomp syscall filters on x86.

BUG=b:169908659
TEST=tast.crostini.SecureCopyPaste.* on scarlet

Change-Id: Ifd44c7b403f862d5528d8cc3655f0cd2c71c6e13
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3276675
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Tested-by: Dennis Kempin <denniskempin@google.com>
2021-11-11 19:31:37 +00:00
Chirantan Ekbote
f01d4b1f16 seccomp: Add unshare to fs device policy
Needed because of CL:3263932

BUG=none
TEST=vm.Fio

Change-Id: I50502476dd9591c114094cc43dda81f2c6e2c516
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3276112
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
2021-11-11 13:38:11 +00:00
David Stevens
5ebe30d0e5 wl: add support for host fences
Add support for guest fences backed by host sync_files. Rather than
adding a new fence type, fences are implemented as vfds that only
support hup. The host simply waits on the sync_file and sends the guest
a hup when the fence is signaled.

BUG=b:169908659
TEST=Revert ag/15543199, resize ArcCameraFpsTest

Change-Id: I8c79ec9f418b1d71150b5a19f500c5ac7a6c9b02
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3199298
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: David Stevens <stevensd@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-11-04 01:24:37 +00:00
Jorge E. Moreira
e40fb21c0d Allow sched_yield in all devices' seccomp policy
The sched_yield system call is somehow called by the code the rust
compiler generates and not directly by the author's implementation. That
along with the fact that it won't get called on every run makes it very
easy to miss when adding a new device (that happened with virtio-snd).
Since that call is quite harmless (it could be argued minijail shouldn't
even block it in the first place) it makes sense to allow it for all
devices.

BUG=b/201306350

Change-Id: I9895da6c8060ae83053474ed9e4472ea2cd8d3e3
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3248126
Auto-Submit: Jorge Moreira Broche <jemoreira@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-10-28 19:10:45 +00:00
Yiwei Zhang
95ac52a975 seccomp: gpu: allow vulkan loader/layer and virglrenderer
This is the arm equivalent for the below x86_64 CLs
- crrev/c/2634993
- crrev/c/2728307
- crrev/c/2959464

BUG=b:203588512
TEST=vkjson

Change-Id: I0f421d88a9abd9568923573d3135c24c513ed7eb
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3232961
Auto-Submit: Yiwei Zhang <zzyiwei@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chia-I Wu <olv@google.com>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Lepton Wu <lepton@chromium.org>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2021-10-20 07:20:27 +00:00
Woody Chow
0c9c4baa7f seccomp: Add timerfd_* to cras_snd_device.policy
Following CL:3047951 for cras_audio_device.
Without these, the device would crash under crostini.

BUG=b:198730031
TEST=tast run $DUT_IP crostini.PulseAudioBasic.*

Change-Id: I87a60b87461ff10594ebe7643a631630eabc94ac
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3213791
Auto-Submit: Woody Chow <woodychow@google.com>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Woody Chow <woodychow@google.com>
2021-10-11 05:10:11 +00:00
Adrian Ratiu
cdedd7000a seccomp: allow newfstatat in more amd64/arm64 policies
newfstatat has been added to a few policies for the
two 64bit architectures, but some more require it to
avoid crashes, so add it to all which contain fstat
or statx.

BUG=b:187795909
TEST=CQ

Change-Id: I3cd0f5379b87102caa256503a888c5a1aa4103b6
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3198571
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2021-10-01 17:09:16 +00:00
Woody Chow
f5183c26be Set rtprio in virtio-snd (cras backend) worker
to 10 (following other cros audio client)

BUG=b:199796992
TEST=Examine output of `ps -AT -eo rtprio,command` when the device
  is running

Change-Id: I1293c693e1bd699788d87d5bc085fd4fd281fff1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3159894
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chih-Yang Hsia <paulhsia@chromium.org>
Commit-Queue: Woody Chow <woodychow@google.com>
2021-09-21 10:49:57 +00:00
Woody Chow
737ff125ca Add virtio-snd device with CRAS backend
Enable with `--cras-snd`.

Verified:
Basic playback and capture

Missing features:
* Getting chmap/jack/stream info from CRAS. They are hardcoded for now.
* Jack connect/disconnect notifications from CRAS
* Reporting latency bytes to the driver. It is currently hardcoded to 0.

BUG=b:179757101
TEST=`aplay` and `arecord` inside a debian img with a 5.10 kernel built
     with virtio snd support. Launched with crosvm on rammus/kukui/hatch

Change-Id: I240000a92418b75b3eb8dcd241ff320214b68739
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2777991
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Woody Chow <woodychow@google.com>
Reviewed-by: Chih-Yang Hsia <paulhsia@chromium.org>
2021-09-02 04:29:55 +00:00
Adrian Ratiu
b08a9e2953 seccomp: allow fstatat64/statx syscalls on arm
On 32bit arm systems, starting with glibc 2.33, the fstatat64
syscall is used to fix a y2038 bug and statx is also called
for 64bit->32bit datastructure conversion.

See this upstream glibc 2.33 commit range for more details:
d892723830..aa03f722f3.

Example failures (only on 32bit arm):
type=SECCOMP comm="mtpd" exe="/usr/sbin/mtpd" sig=0
arch=40000028 syscall=327 code=0x7ffc0000
type=SECCOMP comm="mtpd" exe="/usr/sbin/mtpd" sig=0
arch=40000028 syscall=397 code=0x7ffc0000

BUG=b:187795855
TEST=Local builds; CQ.

Change-Id: I003feeaa75552770920cdf9969a393940c5e997b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3113972
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-08-26 20:59:21 +00:00
Adrian Ratiu
48486f9248 seccomp: make consistent use of faccessat/2
In some places the faccessat and faccessat2 syscalls were
added only for arm64 but starting with glibc 2.33 they are
required on all architectures, so add them to arm and amd64.

BUG=b:187795855
TEST=Local builds; CQ.

Change-Id: Ica4755844fbbd29d31df2967724abe735ab59f7e
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3111369
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-08-24 23:12:34 +00:00
Chirantan Ekbote
b56de80b07 fs: Support fs-verity
Needed by arcvm.

BUG=b:141632062
TEST=Run `fsverity enable $FILE` and `fsverity measure $FILE` inside a
     VM on a virtio-fs mountpoint

Change-Id: Ifb9e7e9c8b924a835971bf298256495d8dc81733
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2387820
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2021-08-23 16:15:03 +00:00
Adrian Ratiu
a0320d286d crosvm: seccomp: allow faccessat2 syscall if it exists
Starting with glibc 2.33 the faccessat2 syscall is used and
only if it doesn't exist (eg kernel older than 5.8) glibc will
default to the older faccessat syscall, so we need to allow it.

Previously this syscall has been enabled on a per-component
basis after testing, but this one does a bulk enable when
faccessat is used on all architectures.

See glibc commit 3d3ab573a5 ("Linux: Use faccessat2 to implement
faccessat (bug 18683")

BUG=b:187795855
TEST=Local builds; CQ.

Change-Id: I1f17e82e8c416b0fa2c43342731e9ea8394c47fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3097212
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-08-19 19:07:35 +00:00
Jordan R Abrahams
6b893cc59f seccomp: Add fstatfs (32bit) to arm policies
This is a commit to future-proof seccomp failures with syscall=100,
fstatfs. On 32bit systems, we've seen programs which use not just
fstatfs64, but also fstatfs. Which one is selected is seemlessly
selected via defines via `statvfs`, depending on the board
(notably scarlet, trogdor, and elm).

See also: https://man7.org/linux/man-pages/man2/statfs.2.html

BUG=b:197006863
TEST=CQ

Change-Id: I6eaea3064671a109d2d7844cde4eae43931c63bf
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3100412
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-08-18 15:17:55 +00:00
Jordan R Abrahams
b785cf2bae seccomp: Mass fstatfs change for glibc for Arm
On trogdor devices, fstatfs64 is not used. Instead, 32bit
fstatfs is used. We need to add both to all 32bit Arm
policy files which were originally determined to be
problematic.

This adds fstsatfs to all 32bit Arm policy files which
were modified for the original glibc security change.

Additionally, this commit sorts the syscalls lexicographically
if the policy file was already sorted.

BUG=chromium:1182687
TEST=CQ of http://crrev.com/c/2910526

Change-Id: I42eb12456625d400ee3422af08d56d648e3f9075
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3066144
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Jordan R Abrahams <ajordanr@google.com>
2021-08-03 08:08:58 +00:00
Chih-Yang Hsia
4dd683a354 ac97: Add timerfd operations to accepted list
Since CL:2999451, libcras is using timerfd features from `cros_async`,
we need to add timerfd operations to the accepted list of
`cras_audio_device`'s seccomp policy files.

BUG=b:179757101
BUG=b:194452080
TEST=tast run ${DUT_IP} arc.Notification.vm

Change-Id: I74b33fa1e304fccc95b7326e04bedc32feff85f1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3047951
Auto-Submit: Chih-Yang Hsia <paulhsia@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-07-23 18:43:21 +00:00
Jordan R Abrahams
e3c53096d7 seccomp: Update seccomp filters for glibc
At present, libraries which use glibc to dynamically load
shared libraries do not have fstafs in their seccomp policies.
A change in glibc will force all systems which load shared
libraries to call the fstatfs or fstatfs64 syscall.

Without the call, crosvm will not start when running
crostini/android tests.

BUG=chromium:1182687
TEST=CQ of https://crrev.com/c/2910526

Change-Id: I10abb8866474c2fe0398a17a80069cf2b0629493
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3011355
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dennis Kempin <denniskempin@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Jordan R Abrahams <ajordanr@google.com>
2021-07-22 17:08:20 +00:00
Chirantan Ekbote
6074d45aeb cros_async: Don't use io_uring on kernels < 5.10
Kernels before 5.10 had known bugs in the io_uring implementation.
Don't use io_uring when we detect this.  Also skip all the io_uring
tests in this case.

BUG=none
TEST=cargo test

Change-Id: I5fd6203ad25a6fb85ff28f1a6ddb0181f836ad89
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3006309
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Woody Chow <woodychow@google.com>
2021-07-14 09:42:39 +00:00
Zide Chen
dfc4b88040 devices: virtio: iommu: enable virtio IOMMU driver
By default virtio-IOMMU is disabled. It can be enabled per pass-through
device. Sample command lines:

default: virtio IOMMU disabled on pass-through device:
--vfio=/sys/bus/pci/devices/0000:00:02.0

Explicitly disable virtio IOMMU:
--vfio=/sys/bus/pci/devices/0000:00:02.0,iommu=off

Enable virtio IOMMU on the desired pass-through device:
--vfio=/sys/bus/pci/devices/0000:00:02.0,iommu=on

BUG=b:181736020
TEST=passthru one device with iommu=on
TEST=passthru two devices with iommu=on from different VFIO group
TEST=passthru two devices with iommu=on from same VFIO group
TEST=passthru one device with iommu=on and another device with iommu=off

Change-Id: Id74d2210f774a90ba5e83671e76e061cb8fec758
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2757276
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: David Stevens <stevensd@chromium.org>
Commit-Queue: David Stevens <stevensd@chromium.org>
2021-07-09 05:49:26 +00:00
Chia-I Wu
d8921baae1 seccomp: gpu: allow getcwd
The Vulkan validation layer wants to search the current working
directory for vk_layer_settings.txt.

BUG=b:191082452
TEST=run vulkan apps in the guest and observe validation errors being
     logged in the host

Change-Id: Iece467f72162efc730b74a8dd6075c7b624aa0bb
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2959464
Reviewed-by: Gurchetan Singh <gurchetansingh@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-06-30 03:10:55 +00:00
hscham
a7fd914538 crosvm: add memfd_create to seccomp policy files
To enable SupportsChannelUpgrade in libchrome (upstream r850346,
crrev.com/c/2670092).

BUG=b:189403036
TEST=tast run $hatch-DUT
         arc.Notification.vm
         arc.CheckAndroidVersion.vm
         arc.RemovableMedia.vm
         arc.Gamepad.vm
         arc.IMEBlockingVK.vm
         security.SELinuxFilesDataDir.vm
         arc.StartStop.vm
         arc.CPUSet.vm
         arc.Optin.vm
         arc.IntentForward.vm
         arc.MIDIClient.vm
         arc.IMESwitchShortcut.vm
         arc.ChromeCrash.vm_logged_in
         arc.Boot.vm
         arc.BuildProperties.vm
         arc.ConciergeCrash
         arc.VMPstoreDump
         security.SELinuxProcessesARC.vm
         security.NetworkListenersARC.vm
     with disable patch removed in libchrome

Change-Id: I1a924c60ebe9707627fdd064b2233a7452d5cc57
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2984719
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Qijiang Fan <fqj@google.com>
Commit-Queue: Grace Cham <hscham@chromium.org>
2021-06-28 04:40:43 +00:00
Jorge E. Moreira
c8cff01c36 Specify prctl's policy only once per device
The libminijail version in AOSP complains when there are multiple entries for
the same system call, which was the case for virtio-fs's policy.

BUG=b/185811304

Change-Id: I389c07c86e7d79f16e4f47a893abad598033352a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2837307
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Tested-by: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-04-20 22:50:20 +00:00
Manoj Gupta
d1d97392ba crosvm: Add utimensat_time64 to arm seccomp
Add utimensat_time64 where utimensat is used.

BUG=b:185515575
TEST=CQ

Change-Id: I2ad841d8f89d779e487a3abf77e158da4ff21bef
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2836891
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Commit-Queue: Muhammad Hasan Khan <mhasank@chromium.org>
2021-04-20 03:22:49 +00:00
Chirantan Ekbote
a00991cd84 Replace dup with fcntl(F_DUPFD_CLOEXEC)
Fds created via dup don't share file descriptor flags with the original
fd, which means that they don't have the FD_CLOEXEC flag set.  Use
fcntl(F_DUPFD_CLOEXEC) so that this flag gets set for the duplicated fds
as well.

BUG=none
TEST=unit tests

Change-Id: Ib471cf40acac1eacf72969ba45247f50b349ed58
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2809687
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2021-04-15 10:34:04 +00:00
Chuanxiao Dong
ac62778ab2 seccomp: vfio: add one policy to allow fcntl
VFIO is updated to use try_clone() to duplicate a File recently.
The try_clone() implementation will use fcntl with the argument
F_DUPFD_CLOEXEC to duplicate the File, so need to add one more
rule in vfio_device.policy to allow it otherwise VFIO will be
failed when sandbox is enabled.

BUG=None
TEST=boot VM with VFIO passthrough + sandbox enabled

Change-Id: I55cce937f1c12a32537aaff8d3ddafa135a674d1
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2816822
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-04-10 00:47:02 +00:00
Chirantan Ekbote
4b47aa7105 fs: Fix device socket
validate_raw_fd assumes that the fd passed in was not created by crosvm
and returns EBADF if it sees that the fd has the FD_CLOEXEC flag set.
We can't use it for fds created by the fs device since those do have
that flag set.

We're already taking a `&dyn AsRawFd` as the parameter so just assume
it's valid and clone it directly since there's no safe way to create an
invalid one.

BUG=none
TEST=vm.Fio.virtiofs_dax* tests are no longer failing

Change-Id: I10d9752e0960143fb58a63d2b76f64d34ec464d0
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2809686
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
2021-04-09 08:04:30 +00:00
Gurchetan Singh
b66d6f62dc crosvm: sandbox changes for udmabuf
Allow:
   - UDMABUF_CREATE_LIST -- needed to create udmabuf
   - DMA_BUF_IOCTL_SYNC -- to flush the udmabuf.
     virtio-wl already allows this everywhere so
     this should be fine.

Also add the path to minijail.

BUG=chromium:892806, b:173630595
TEST=no sandbox violations

Change-Id: I70ace6ef0349c4b133615eb41f9f56ccd7121e4b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2786287
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Gurchetan Singh <gurchetansingh@chromium.org>
Commit-Queue: Gurchetan Singh <gurchetansingh@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-30 16:42:00 +00:00
Chirantan Ekbote
53ef751fb3 seccomp: 9p: Allow fchown and fchmod
Needed by upcoming implementation changes.

BUG=chromium:1082345,chromium:920262,chromium:912599
TEST=`emerge-$BOARD crosvm`

Change-Id: Id366cd9d0bb3af24e2445fdf897d6ef45ae88115
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2784163
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-24 18:59:02 +00:00
Manoj Gupta
d4d0b5ccf3 crosvm: add more time syscalls to policies
glibc 2.32 is using clock_gettime/64 on some arm boards
when gettimeofday is used. In addition, support 64-bit
variants of the time syscalls for use with glibc 2.32.

BUG=chromium:1190305
TEST=crostini tests pass

Change-Id: I070eee92817d3f959ea385ff2c3adca610e0a574
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2776211
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-20 13:40:00 +00:00
Manoj Gupta
4029491dfe block_device.policy: Add arm time64 variants
Add time64 variants for crosvm.

BUG=chromium:1188714
TEST=no more crashes when installing Linux

Change-Id: I5bacb0436b6002aef059dd619ac0cc80995315aa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2774389
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Auto-Submit: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-03-19 01:40:03 +00:00
Manoj Gupta
19ad688208 add getdents64 to policies
glibc 2.32 is using getdents64 syscall instead of getdents.
So add getdents64 to policies that already have getdents.

BUG=chromium:1171287
TEST=CQ

Change-Id: Icbe1da7cbf669432c8160779a9cbfdeb04db57c0
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2760299
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-03-16 05:25:16 +00:00
Chirantan Ekbote
7b98502972 fs: Don't drop caps when changing UID
Set the SECBIT_NO_SETUID_FIXUP securebit so that we don't lose
capabilities when changing the thread uid/gid.  This allows us to
simplify the create and mkdir functions so that all the checks we
currently carry out are only done once by the host kernel.

To ensure that the setuid and setgid bits still get dropped when a file
is modified by a process that doesn't hold CAP_FSETID, check for
WRITE_KILL_PRIV in the write flags and temporarily drop CAP_FSETID when
it is set.

BUG=none
TEST=Check that default posix acls, setgid bits, and file/directory
     creation via membership of a supplementary group all work as
     expected.

Change-Id: I420484e357a970e997cb3e968a433278e82d8ad4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2684067
Auto-Submit: Chirantan Ekbote <chirantan@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-12 04:11:58 +00:00
Lepton Wu
e0598548aa seccomp: arm: Allow getrandom for video device.
libvda depends on libchrome and libchrome changed to use
getrandom since http://crrev.com/c/2380673

BUG=b:182223105
TEST=manual - Push updated policy file to kukui and run ARCVM.

Change-Id: I135121fc824ab07f114dd84e1a2a36fc9b8d5896
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2745819
Tested-by: Lepton Wu <lepton@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Lepton Wu <lepton@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
2021-03-10 03:01:09 +00:00
John Bates
d854217d99 ac97: null audio device also needs sched_setscheduler
Updating seccomp for null audio device.

BUG=None
TEST=run crosvm with null audio device fallback

Change-Id: Iadcbd5b68fa36427782a66f66046fe5a907c2470
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2740644
Tested-by: John Bates <jbates@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Auto-Submit: John Bates <jbates@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: John Bates <jbates@chromium.org>
2021-03-08 22:29:31 +00:00
Adrian Ratiu
f19933bfb0 tree-wide: seccomp: allow clock_nanosleep syscalls
Starting with 2.32 glibc nanosleep() was refactored to use the
clock_nanosleep syscall so various software will fail unless
the new syscall is allowed. We can't just drop the old nanosleep
syscall because it will break glibc 2.27 which is still used.

See glibc commits:
807edded25 nptl: Refactor thrd_sleep in terms of clock_nanosleep
3537ecb49c Refactor nanosleep in terms of clock_nanosleep
79a547b162 nptl: Move nanosleep implementation to libc

This is a bulk edit done with the following command:
git grep -rl 'nanosleep: 1' | xargs sed -i \
                           '/^nanosleep: 1/a clock_nanosleep: 1'

BUG=chromium:1171287
TEST=Local builds and booting on kevin/64/eve/minnie.

Change-Id: I975535078d88200f52319c7eea3a4c7ebf299933
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2735575
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-07 01:53:10 +00:00
Chia-I Wu
3c6367b98c seccomp: gpu: allow sched_yield
It will be needed by virglrenderer with venus enabled.

BUG=b:180621453
TEST=vulkan-smoketest

Change-Id: I3c3b4f38901d278c137b26f8801a3417d88b4533
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2728307
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Chia-I Wu <olv@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-03-05 05:13:36 +00:00
Daniel Verkamp
8ef81401dd devices: virtio: block: fix arm fcntl syscall
The arm version of libc uses the fcntl64 syscall (0xdd); update the
seccomp policy to match the other arm policies.

BUG=chromium:901139
TEST=Boot Crostini on kevin (arm)

Change-Id: I82eee1ec4918a56495d6c330913c34d4a4a20e4b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2705290
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: kokoro <noreply+kokoro@google.com>
Tested-by: Dylan Reid <dgreid@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2021-02-19 06:30:01 +00:00
Dylan Reid
503c5abef6 devices: Add an asynchronous block device
This enables the use of basic disk images with async IO. A new
block_async.rs is added which mostly mirrors block, except that all
IO operations are asynchronous allowing for multiple virt queues to be
used.

The old block remains unchanged and is still used for qcow, android
sparse, and composite disks. Those should be converted to as time
allows, but this dual approach will have to do for now so ARCVM disk
performance can be properly evaluated.

fio --ioengine=libaio --randrepeat=1 --direct=1 --gtod_reduce=1
--name=test --filename=test --bs=4k --iodepth=64 --size=4G
--readwrite=randrw --rwmixread=75

desktop with nvme:

before:
READ: bw=36.2MiB/s (37.9MB/s), 36.2MiB/s-36.2MiB/s (37.9MB/s-37.9MB/s),
io=3070MiB (3219MB), run=84871-84871msec
WRITE: bw=12.1MiB/s (12.7MB/s), 12.1MiB/s-12.1MiB/s (12.7MB/s-12.7MB/s),
io=1026MiB (1076MB), run=84871-84871msec
after:
READ: bw=257MiB/s (269MB/s), 257MiB/s-257MiB/s (269MB/s-269MB/s),
io=3070MiB (3219MB), run=11964-11964msec
WRITE: bw=85.8MiB/s (89.9MB/s), 85.8MiB/s-85.8MiB/s (89.9MB/s-89.9MB/s),
io=1026MiB (1076MB), run=11964-11964msec

samus with 5.6 kernel
before:
READ: bw=55.3MiB/s (57.9MB/s), 55.3MiB/s-55.3MiB/s (57.9MB/s-57.9MB/s),
io=768MiB (805MB), run=13890-13890msec
WRITE: bw=18.5MiB/s (19.4MB/s), 18.5MiB/s-18.5MiB/s (19.4MB/s-19.4MB/s),
io=256MiB (269MB), run=13890-13890msec
after:
READ: bw=71.2MiB/s (74.7MB/s), 71.2MiB/s-71.2MiB/s (74.7MB/s-74.7MB/s),
io=3070MiB (3219MB), run=43096-43096msec
WRITE: bw=23.8MiB/s (24.0MB/s), 23.8MiB/s-23.8MiB/s (24.0MB/s-24.0MB/s),
io=1026MiB (1076MB), run=43096-43096msec

kevin with 5.6 kernel
before:
READ: bw=12.9MiB/s (13.5MB/s), 12.9MiB/s-12.9MiB/s (13.5MB/s-13.5MB/s),
io=1534MiB (1609MB), run=118963-118963msec
WRITE: bw=4424KiB/s (4530kB/s), 4424KiB/s-4424KiB/s (4530kB/s-4530kB/s),
io=514MiB (539MB), run=118963-118963msec
after:
READ: bw=12.9MiB/s (13.5MB/s), 12.9MiB/s-12.9MiB/s (13.5MB/s-13.5MB/s),
io=1534MiB (1609MB), run=119364-119364msec
WRITE: bw=4409KiB/s (4515kB/s), 4409KiB/s-4409KiB/s (4515kB/s-4515kB/s),
io=514MiB (539MB), run=119364-119364msec

eve with nvme and 5.7 kernel
before:
READ: bw=49.4MiB/s (51.8MB/s), 49.4MiB/s-49.4MiB/s (51.8MB/s-51.8MB/s),
io=3070MiB
(3219MB), run=62195-62195msec
WRITE: bw=16.5MiB/s (17.3MB/s), 16.5MiB/s-16.5MiB/s (17.3MB/s-17.3MB/s),
io=1026MiB
 (1076MB), run=62195-62195msec
after
READ: bw=125MiB/s (131MB/s), 125MiB/s-125MiB/s (131MB/s-131MB/s),
io=3070MiB (3219MB), run=24593-24593msec
WRITE: bw=41.7MiB/s (43.7MB/s), 41.7MiB/s-41.7MiB/s
(43.7MB/s-43.7MB/s), io=1026MiB (1076MB), run=24593-24593msec

rammus with 5.10 kernel
before:
READ: bw=6927KiB/s (7093kB/s), 6927KiB/s-6927KiB/s (7093kB/s-7093kB/s),
io=3070MiB (3219MB), run=453822-453822msec
WRITE: bw=2315KiB/s (2371kB/s), 2315KiB/s-2315KiB/s (2371kB/s-2371kB/s),
io=1026MiB (1076MB), run=453822-453822msec
after:
Run status group 0 (all jobs):
READ: bw=10.0MiB/s (11.5MB/s), 10.0MiB/s-10.0MiB/s (11.5MB/s-11.5MB/s),
io=3070MiB (3219MB), run=279111-279111msec
WRITE: bw=3764KiB/s (3855kB/s), 3764KiB/s-3764KiB/s (3855kB/s-3855kB/s),
io=1026MiB (1076MB), run=279111-279111msec

BUG=chromium:901139
TEST=unitests
TEST=boot a test image and run fio tests from the guest to measure speed.
TEST=start ARCVM
TEST=tast run $DUT crostini.ResizeOk.dlc_stretch_stable

Change-Id: Idb63628871d0352bd18501a69d9c1c887c37607b
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2306786
Tested-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
2021-02-17 04:11:55 +00:00
Dylan Reid
592f3275dd devices: Use async from balloon
The newly added async primitives allow for increasing the separation of
the various tasks performed by balloon. Breaking each task in to an
asynchronous function.

BUG=chromium:901139
TEST=Boot crosvm, run 'crosvm balloon' to set the balloon size, check
'vmstat' inside the VM to verify the free memory is affected by the
balloon growing and shrinking.
run crosvm balloon_stats command and ensure that stats are reported
correctly.

Change-Id: I0ae2be5eb8e4be65b2eb74de90888357af6ecfd4
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1993163
Tested-by: Keiichi Watanabe <keiichiw@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
2021-02-12 18:27:45 +00:00
Rob Clark
febb71cfb1 seccomp: Update arm/aarch64 gpu_device.policy for Mesa
An upcoming mesa-freedreno uprev will require a couple crosvm policy
updates.  In particular setscheduler/setaffinity, for the same reasons
that AMD requires them.

BUG=b:179519741
TEST=Start crostini with upstream mesa MR that starts requiring
     setscheduler/setaffinity

Change-Id: I4f41a638f413b35f2afebdbe39dde02a02f8322a
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2683032
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Rob Clark <robdclark@chromium.org>
Commit-Queue: Rob Clark <robdclark@chromium.org>
Auto-Submit: Rob Clark <robdclark@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-02-11 03:49:59 +00:00
Jorge E. Moreira
359e7de9a1 Add the VioS audio backend
It only supports playback streams, with capture streams to be added in
a different change.

BUG=b/171602855

Change-Id: Id9a5a560506f8fd026ef3ed83f8d14b29389e329
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2574813
Tested-by: Jorge Moreira Broche <jemoreira@google.com>
Commit-Queue: Jorge Moreira Broche <jemoreira@google.com>
Auto-Submit: Jorge Moreira Broche <jemoreira@google.com>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Chih-Yang Hsia <paulhsia@chromium.org>
Reviewed-by: Zach Reizner <zachr@chromium.org>
2021-02-01 23:47:02 +00:00
Chia-I Wu
694c53031a seccomp: gpu: allow vulkan loader and intel anv
BUG=b:176158397
TEST=vkcube

Change-Id: I11b5a97929fbb2c0328aca7d54b5882823b67209
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2634993
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
Tested-by: Chia-I Wu <olv@google.com>
Commit-Queue: Chia-I Wu <olv@google.com>
2021-01-22 13:28:33 +00:00
Daniel Verkamp
c7236f2cf1 seccomp: allow USBDEVFS_CLEAR_HALT
This USB ioctl is used in usb_util::Device::clear_halt(), but it was not
allowed in the seccomp policy.

BUG=chromium:1167286
TEST=Attach Keyspan USA-19H USB serial adapter to Crostini

Change-Id: I625cde121a0a248046e476eecd732a98530811dc
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2633824
Reviewed-by: Matthew Blecker <matthewb@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Matthew Blecker <matthewb@chromium.org>
Commit-Queue: Matthew Blecker <matthewb@chromium.org>
2021-01-22 05:00:05 +00:00
John Bates
0d9d0e3c85 Allow perfetto tracing from crosvm gpu process
New syscalls and /run/perfetto bind mount are required.

BUG=b:174162684
TEST=Run crosvm with perfetto instrumentation and confirm that
     events can be traced through traced. Tested on both hatch
     and ARM kukui device.

Cq-Depend: chromium:2570487
Change-Id: I809400ec393c2971ba9a1134ddbef7f48d818786
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2571659
Reviewed-by: Zach Reizner <zachr@chromium.org>
Reviewed-by: David Riley <davidriley@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: John Bates <jbates@chromium.org>
Commit-Queue: John Bates <jbates@chromium.org>
2020-12-10 04:40:43 +00:00
Chirantan Ekbote
8e06159af3 virtiofs: Support FS_IOC_GET_ENCRYPTION_POLICY_EX
Needed by arcvm.  Also fix some style issues with the previous ioctl
definitions.

BUG=b:136127632
TEST=Call this ioctl from inside a VM and see that it is passed through
     to the host.

Change-Id: Icdeff9e2c5b15237ed49e6814b8147258a50ccab
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2560286
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2020-12-08 00:26:39 +00:00