mirror of
https://chromium.googlesource.com/crosvm/crosvm
synced 2025-02-11 20:56:12 +00:00
5124d62f86
With these changes arcvm starts when running with 64-bit userspace and this grep turns up blank: grep SECCOMP /var/log/audit/audit.log Generated by: * Hacking minijail0 to always log <https://r.android.com/2072091> and making sure it was compiled in debug mode. * Hacking "crosvm run" to be "crosvm run --seccomp-log-failures". I don't truly know if this is needed but it didn't hurt. * Diffing arm vs. arm64 From comparing arm vs. arm64 there could still be some things missing, or it's possible that arm has simply accumulated some cruft. More can be added later if we find it's needed. BUG=b:223410173, b:230609113 TEST=Start arcvm; start android-sh; run tast arc.VMConfig Change-Id: Ib5407ddecc3d19f43e14e5b036ac64baee9335bb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3543889 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Auto-Submit: Douglas Anderson <dianders@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Douglas Anderson <dianders@chromium.org>
89 lines
1.8 KiB
Text
89 lines
1.8 KiB
Text
# Copyright 2021 The Chromium OS Authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
# Rules from common_device.policy with some rules removed because they block certain flags needed
|
|
# for gpu.
|
|
brk: 1
|
|
clock_gettime: 1
|
|
close: 1
|
|
dup3: 1
|
|
dup: 1
|
|
epoll_create1: 1
|
|
epoll_ctl: 1
|
|
epoll_pwait: 1
|
|
eventfd2: 1
|
|
exit: 1
|
|
exit_group: 1
|
|
futex: 1
|
|
getcwd: 1
|
|
getpid: 1
|
|
gettid: 1
|
|
gettimeofday: 1
|
|
kill: 1
|
|
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
|
|
mremap: 1
|
|
munmap: 1
|
|
nanosleep: 1
|
|
clock_nanosleep: 1
|
|
pipe2: 1
|
|
ppoll: 1
|
|
prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
|
|
read: 1
|
|
readlinkat: 1
|
|
readv: 1
|
|
recvfrom: 1
|
|
recvmsg: 1
|
|
restart_syscall: 1
|
|
rt_sigaction: 1
|
|
rt_sigprocmask: 1
|
|
rt_sigreturn: 1
|
|
sched_getaffinity: 1
|
|
sendmsg: 1
|
|
sendto: 1
|
|
set_robust_list: 1
|
|
sigaltstack: 1
|
|
write: 1
|
|
writev: 1
|
|
uname: 1
|
|
|
|
# Required for perfetto tracing
|
|
getsockopt: 1
|
|
shutdown: 1
|
|
|
|
## Rules specific to gpu
|
|
connect: 1
|
|
getrandom: 1
|
|
lseek: 1
|
|
ftruncate: 1
|
|
statx: 1
|
|
fstat: 1
|
|
newfstatat: 1
|
|
getdents64: 1
|
|
sysinfo: 1
|
|
fstatfs: 1
|
|
|
|
# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
|
|
ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543
|
|
|
|
## mmap/mprotect differ from the common_device.policy
|
|
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
|
|
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
|
|
openat: 1
|
|
|
|
## Rules specific to pvr
|
|
geteuid: 1
|
|
getuid: 1
|
|
fcntl: 1
|
|
tgkill: 1
|
|
|
|
# Rules specific to Mesa.
|
|
sched_setscheduler: 1
|
|
sched_setaffinity: 1
|
|
kcmp: 1
|
|
|
|
# Rules for Vulkan loader / layers
|
|
faccessat: 1
|
|
faccessat2: 1
|
|
getgid: 1
|
|
getegid: 1
|