crosvm/seccomp/x86_64/block.policy
Alexandre Courbot 82b1bec6b0 crosvm: add block support to "devices" command
Add support for creating block devices using the `crosvm devices`
command.

Due to conflicting seccomp policies between vhost-user transport and the
block device, we need to temporarily remove some lines from
vhost_user.policy and vvu.policy and reproduce them in the serial
device's policy. This will be handled properly later using a new seccomp
policy parser.

BUG=b:217480043
TEST=`crosvm devices --block vhost=/tmp/vu-block,path=disk.img` results
in a working vhost-user block device.
TEST=`crosvm devices --block vhost=0000:00:10.0,path=disk.img` results
in a working VVU block device.
TEST=regular virtio block device is usable as jailed root device.

Change-Id: Ide62adbf81390eb39cd10f3d2880e2c065982d05
Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3765000
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
Commit-Queue: Alexandre Courbot <acourbot@chromium.org>
Tested-by: Alexandre Courbot <acourbot@chromium.org>
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
2022-08-04 04:00:31 +00:00

22 lines
452 B
Text

# Copyright 2022 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
fallocate: 1
fdatasync: 1
fstat: 1
fsync: 1
ftruncate: 1
lseek: 1
open: return ENOENT
openat: return ENOENT
newfstatat: 1
pread64: 1
preadv: 1
pwrite64: 1
pwritev: 1
statx: 1
timerfd_create: 1
timerfd_gettime: 1
timerfd_settime: 1
prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_PDEATHSIG