Alexandre Courbot c553d1c283 seccomp: define naming rules for policy files ... We are going to use separate policy files per device for the following scenarios: 1) Regular in-VMM virtio device, 2) Virtio device over vhost-user, 3) Virtio device over Vvu. Each of these scenarios require slightly different policies as a jailed device process needs to allow not only the system calls necessary for the device to function, but also those required by the virtio transport in use. This CL adds a README.md file to the seccomp directory that details the naming and policy inclusion rules, and updates the serial, xhci and coiommu policies to follow the naming scheme. Vhost-user and VVU policy files will be added along with support for jailing devices when they are in use. BUG=b:217480043 TEST=serial device works with `crosvm run`. Change-Id: I6d454aa6e05d00691fe3346e822ed1fc7b24aed8 Signed-off-by: Alexandre Courbot <acourbot@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3706490 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>		2022-06-17 04:35:09 +00:00
..
9p_device.policy	seccomp: Add fstatfs (32bit) to arm policies	2021-08-18 15:17:55 +00:00
balloon_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
battery.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
block_device.policy	seccomp: allow fstatat64/statx syscalls on arm	2021-08-26 20:59:21 +00:00
coiommu_device.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00
common_device.policy	seccomp: add getcwd and readlink to common policy for panic	2021-12-02 23:18:03 +00:00
cras_audio_device.policy	seccomp: Allow lseek on cras_audio_device	2021-11-29 23:28:45 +00:00
cras_snd_device.policy	seccomp: Add timerfd_* to cras_snd_device.policy	2021-10-11 05:10:11 +00:00
fs_device.policy	seccomp: add getcwd and readlink to common policy for panic	2021-12-02 23:18:03 +00:00
gpu_common.policy	seccomp: Add io_uring_setup / io_uring_enter to gpu_common.policy	2022-05-06 22:09:01 +00:00
gpu_device.policy	gpu: allow syslog from the render server	2021-12-14 16:54:22 +00:00
gpu_render_server.policy	gpu_render_server: allow syslog and signalfd again	2021-12-22 06:01:25 +00:00
input_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
net_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
null_audio_device.policy	audio: Add lseek in null_audio_device policy	2022-05-30 03:20:47 +00:00
pmem_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
rng_device.policy	devices: Update rng devices to be platform agnostic	2022-05-25 01:35:13 +00:00
serial.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00
serial_device.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00
tpm_device.policy	seccomp: use common_device.policy in tpm_device.policy	2022-02-23 19:23:31 +00:00
vhost_net_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
vhost_vsock_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
video_device.policy	seccomp: Allow statx for video device on arm	2021-11-18 08:50:57 +00:00
vios_audio_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
wl_device.policy	wl: update seccomp policies for SYNC_IOC_FILE_INFO on arm	2021-11-11 19:31:37 +00:00
xhci_device.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00