crosvm/seccomp/aarch64/xhci.policy
Adrian Ratiu a0320d286d crosvm: seccomp: allow faccessat2 syscall if it exists
Starting with glibc 2.33 the faccessat2 syscall is used and
only if it doesn't exist (eg kernel older than 5.8) glibc will
default to the older faccessat syscall, so we need to allow it.

Previously this syscall has been enabled on a per-component
basis after testing, but this one does a bulk enable when
faccessat is used on all architectures.

See glibc commit 3d3ab573a5 ("Linux: Use faccessat2 to implement
faccessat (bug 18683")

BUG=b:187795855
TEST=Local builds; CQ.

Change-Id: I1f17e82e8c416b0fa2c43342731e9ea8394c47fa
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3097212
Reviewed-by: Keiichi Watanabe <keiichiw@chromium.org>
Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
2021-08-19 19:07:35 +00:00

39 lines
1.3 KiB
Text

# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
@include /usr/share/policy/crosvm/common_device.policy
statx: 1
readlinkat: 1
getdents64: 1
name_to_handle_at: 1
faccessat: 1
faccessat2: 1
gettid: 1
clock_gettime: 1
timerfd_create: 1
getsockname: 1
openat: 1
setsockopt: 1
bind: 1
socket: arg0 == AF_NETLINK
# The following ioctls are:
# 0x4004550d == USBDEVFS_REAPURBNDELAY32
# 0x550b == USBDEVFS_DISCARDURB
# 0x8004550f == USBDEVFS_CLAIMINTERFACE
# 0x80045510 == USBDEVFS_RELEASEINTERFACE
# 0x80045515 == USBDEVFS_CLEAR_HALT
# 0x8004551a == USBDEVFS_GET_CAPABILITIES
# 0x802c550a == USBDEVFS_SUBMITURB
# 0xc0105500 == USBDEVFS_CONTROL
# 0x5514 == USBDEVFS_RESET
# 0x80045505 == USBDEVFS_SETCONFIGURATION
# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
# 0x40085511 == USBDEVFS_CONNECTINFO
# 0x80185520 == USBDEVFS_CONNINFO_EX
ioctl: arg1 == 0xc0105500 || arg1 == 0x802c550a || arg1 == 0x8004551a || arg1 == 0x4004550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520
fstat: 1
getrandom: 1
lseek: 1
prctl: arg0 == PR_SET_NAME