mirror of
https://chromium.googlesource.com/crosvm/crosvm
synced 2025-02-11 04:26:38 +00:00
4b3db6786c
By default, KSM is disabled by the kernel. This is harmless if KSM is disabled, and only causes merging if the user manually enabled the feature on their kernel. If enabled, significant memory saving can occur, at the cost of CPU cycles and a reduction in privacy. Bug: 1346340 Change-Id: I838cdda97ea8d335b1953dd6775311958069898c Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3780870 Reviewed-by: David Manouchehri <david@davidmanouchehri.com> Tested-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
93 lines
1.8 KiB
Text
93 lines
1.8 KiB
Text
# Copyright 2020 The Chromium OS Authors. All rights reserved.
|
|
# Use of this source code is governed by a BSD-style license that can be
|
|
# found in the LICENSE file.
|
|
|
|
# Rules from common_device.policy with mmap and mprotect removed because the video device needs
|
|
# to allow more arguments for them.
|
|
brk: 1
|
|
clock_gettime: 1
|
|
clone: arg0 & CLONE_THREAD
|
|
close: 1
|
|
dup2: 1
|
|
dup: 1
|
|
epoll_create1: 1
|
|
epoll_ctl: 1
|
|
epoll_wait: 1
|
|
eventfd2: 1
|
|
exit: 1
|
|
exit_group: 1
|
|
futex: 1
|
|
getcwd: 1
|
|
getpid: 1
|
|
gettid: 1
|
|
gettimeofday: 1
|
|
io_uring_setup: 1
|
|
io_uring_enter: 1
|
|
kill: 1
|
|
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE
|
|
mremap: 1
|
|
munmap: 1
|
|
nanosleep: 1
|
|
clock_nanosleep: 1
|
|
pipe2: 1
|
|
poll: 1
|
|
ppoll: 1
|
|
read: 1
|
|
readlink: 1
|
|
readlinkat: 1
|
|
readv: 1
|
|
recvfrom: 1
|
|
recvmsg: 1
|
|
restart_syscall: 1
|
|
rseq: 1
|
|
rt_sigaction: 1
|
|
rt_sigprocmask: 1
|
|
rt_sigreturn: 1
|
|
sched_getaffinity: 1
|
|
sched_yield: 1
|
|
sendmsg: 1
|
|
sendto: 1
|
|
set_robust_list: 1
|
|
sigaltstack: 1
|
|
write: 1
|
|
writev: 1
|
|
fcntl: 1
|
|
uname: 1
|
|
|
|
# Syscalls specific to video devices.
|
|
clock_getres: 1
|
|
connect: 1
|
|
getdents: 1
|
|
getdents64: 1
|
|
getegid: 1
|
|
geteuid: 1
|
|
getgid: 1
|
|
getresgid: 1
|
|
getresuid: 1
|
|
getsockname: 1
|
|
getuid: 1
|
|
# ioctl: arg1 == DRM_IOCTL_*
|
|
ioctl: arg1 & 0x6400
|
|
memfd_create: 1
|
|
newfstatat: 1
|
|
openat: 1
|
|
setpriority: 1
|
|
socket: arg0 == AF_UNIX
|
|
stat: 1
|
|
fstat: 1
|
|
fstatfs: 1
|
|
statx: 1
|
|
|
|
# Rules needed for minigbm on AMD devices.
|
|
getrandom: 1
|
|
lstat: 1
|
|
# mmap/mprotect differ from the common_device.policy
|
|
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
|
|
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
|
|
sched_setaffinity: 1
|
|
sched_setscheduler: arg1 == SCHED_IDLE || arg1 == SCHED_BATCH
|
|
|
|
# Required by mesa on AMD GPU
|
|
sysinfo: 1
|
|
|
|
prctl: arg0 == PR_SET_NAME
|