mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2025-02-09 20:04:20 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp
History
Alexandre Courbot 4fec994d63 crosvm: add serial support to "devices" command 
Add support for creating serial devices using the `crosvm devices`
command.

BUG=b:217480043
TEST=`crosvm devices --serial hardware=virtio-console,console,stdin,type=stdout,earlycon,vhost=/tmp/vu-serial`
results in a working vhost-user serial device.
TEST=`crosvm devices --serial hardware=virtio-console,console,stdin,type=stdout,earlycon,vhost=0000:00:10.0`
results in a working VVU serial device.

Change-Id: I06fa4c8e27e90fa00c64b38dd25c7e9a91ee77fc
Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3762975
Reviewed-by: Morg <morg@chromium.org>
Commit-Queue: Alexandre Courbot <acourbot@chromium.org>
Tested-by: Alexandre Courbot <acourbot@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
2022-08-02 09:21:30 +00:00
..
aarch64 base: Allow memory to be merged with KSM on Linux. 2022-08-01 18:04:43 +00:00
arm base: Allow memory to be merged with KSM on Linux. 2022-08-01 18:04:43 +00:00
x86_64 crosvm: add serial support to "devices" command 2022-08-02 09:21:30 +00:00
README.md seccomp: define naming rules for policy files 2022-06-17 04:35:09 +00:00

README.md

Policy files for crosvm

This folder holds the seccomp policies for crosvm devices, organized by architecture.

Each crosvm device can run within its owned jailed process. A jailed process is only able to perform the system calls specified in the seccomp policy file the jail has been created with, which improves security as a rogue process cannot perform any system call it wants.

Each device can run from different contexts, which require a different set of authorized system calls. This file explains how the policy files are named in order to allow these various scenario.

Naming conventions

Since Minijail only allows for one level of policy inclusion, we need to be a little bit creative in order to minimize policy duplication.

  • common_device.policy contains a set of syscalls that are common to all devices, and is never loaded directly - only included from other policy files.
  • foo.policy contains the set of syscalls that device foo is susceptible to use, regardless of the underlying virtio transport. This policy is also never loaded directly.
  • foo_device.policy is the policy that is loaded when device foo is used as an in-VMM (i.e. regular virtio) device. It will generally simply include common_device.policy as well as foo.policy.

When using vhost-user, the virtio protocol needs to be sent over a different medium, e.g. a Unix socket. Supporting this transport requires some extra system calls after the device is jailed, and thus dedicated policies:

  • vhost_user.policy contains the set of syscalls required by the regular (i.e. socket-based) vhost-user listener. It is never loaded directly.
  • vvu.policy contains the set of syscalls required by the VFIO-based vhost-user (aka Virtio-Vhost-User) listener. It is also never loaded directly.
  • foo_device_vhost_user.policy is the policy that is loaded when device foo is used as a regular vhost-user device. It will generally include common_device.policy, vhost_user.policy and foo.policy.
  • foo_device_vvu.policy is the policy that is loaded when device foo is used as a VVU device. It will generally include common_device.policy, vvu.policy and foo.policy.