mirror of
https://chromium.googlesource.com/crosvm/crosvm
synced 2024-10-25 05:35:41 +00:00
4389dab579
Minijail's policy compiler complains when there's multiple unconditional rules for a syscall. In most cases the rules are redundant to common_device.policy. I don't know what to do about the intentionally contradictory rules for open and openat, other than to remove then from the common device policy and add it to all the others. BUG=None TEST=Ran compile_seccomp_policy.py until it stopped complaining. Change-Id: I6813dd1e0b39e975415662bd7de74c25a1be9eb3 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1918607 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
22 lines
744 B
Text
22 lines
744 B
Text
# Copyright 2018 The Chromium OS Authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
@include /usr/share/policy/crosvm/common_device.policy
|
|
|
|
# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
|
|
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
|
|
# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC
|
|
ioctl: arg1 == 0x5421 || arg1 == 0x40086200
|
|
connect: 1
|
|
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
|
|
memfd_create: arg1 == 3
|
|
# Used to set of size new memfd
|
|
ftruncate: 1
|
|
# Used to determine shm size after recvmsg with fd
|
|
lseek: 1
|
|
# Allow F_GETFL only
|
|
fcntl: arg1 == 3
|
|
open: return ENOENT
|
|
openat: return ENOENT
|