Daniel Verkamp 9f86c7a221 seccomp: return error from socket for TPM device ... The crosvm TPM process calls ssleay_rand_bytes(), which in some cases attempts to acquire entropy through an EGD ("entropy gathering daemon") - see OpenSSL's RAND_query_egd_bytes(). Attempting to communicate with this daemon by creating a socket would cause the process to exit currently because the syscall whitelist did not allow socket() or connect(). Since we don't have an EGD and don't want to expose it to the sandboxed TPM process anyway, modify the TPM seccomp policy to cause socket() to return an error rather than aborting. BUG=None TEST=`vmc start --software-tpm termina` Change-Id: Ib7c6bceced0f6cbe7199614ece8446aa300cec1e Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1684411 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>		2019-07-09 23:34:57 +00:00
..
9p_device.policy
balloon_device.policy
block_device.policy
common_device.policy
cras_audio_device.policy
input_device.policy
net_device.policy
null_audio_device.policy
pmem_device.policy	devices: Add separate seccomp policy for pmem device	2019-06-21 21:47:58 +00:00
rng_device.policy
tpm_device.policy	seccomp: return error from socket for TPM device	2019-07-09 23:34:57 +00:00
vhost_net_device.policy
vhost_vsock_device.policy
wl_device.policy
xhci.policy	usb: Arm seccomp policy needs _llseek, not lseek	2019-06-27 17:07:01 +00:00