mirror of
https://chromium.googlesource.com/crosvm/crosvm
synced 2024-10-25 05:35:41 +00:00
b22b6137aa
Sandboxing only works when started as chronos via concierge client. If started directly via crosvm as root, the jail will not have proper group permissions to access the Wayland socket. BUG=chromium:837073 TEST=build with --features=gpu; null_platform_test without --disable-sandbox CQ-DEPEND=CL:1213779 Change-Id: I6331f7ae1f5b99d31ad44cf158f72337294771f0 Reviewed-on: https://chromium-review.googlesource.com/1181168 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
58 lines
1.5 KiB
Text
58 lines
1.5 KiB
Text
# Copyright 2018 The Chromium OS Authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
open: 1
|
|
close: 1
|
|
sigaltstack: 1
|
|
munmap: 1
|
|
write: 1
|
|
# Allow mmap to allow loading of GL shared libraries.
|
|
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC
|
|
restart_syscall: 1
|
|
exit_group: 1
|
|
rt_sigreturn: 1
|
|
# Allow MADV_DONTDUMP only.
|
|
madvise: arg2 == MADV_DONTDUMP || arg2 == MADV_DONTNEED
|
|
# Used to determine shm size after recvmsg with fd.
|
|
lseek: 1
|
|
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
|
|
sched_getaffinity: 1
|
|
set_robust_list: 1
|
|
exit: 1
|
|
getpid: 1
|
|
recvfrom: 1
|
|
dup: 1
|
|
eventfd2: 1
|
|
futex: 1
|
|
# Disallow clone's other than new threads.
|
|
# arg0 is flags. Because kernel.
|
|
clone: arg0 & 0x00010000
|
|
# arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == DMA_BUF_IOCTL_SYNC ||
|
|
# arg1 & DRM_IOCTL
|
|
ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400
|
|
fstat: 1
|
|
# Used to communicate with wayland.
|
|
recvmsg: 1
|
|
sendmsg: 1
|
|
poll: 1
|
|
getrandom: 1
|
|
read: 1
|
|
geteuid: 1
|
|
getuid: 1
|
|
readlink: 1
|
|
getdents: 1
|
|
stat: 1
|
|
epoll_create1: 1
|
|
epoll_ctl: 1
|
|
epoll_wait: 1
|
|
# Used to connect to wayland.
|
|
# arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
|
|
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
|
|
connect: 1
|
|
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
|
|
memfd_create: arg1 == 3
|
|
# Used to set of size new memfd.
|
|
ftruncate: 1
|
|
fcntl: arg1 == F_DUPFD_CLOEXEC
|