Alexandre Courbot c553d1c283 seccomp: define naming rules for policy files ... We are going to use separate policy files per device for the following scenarios: 1) Regular in-VMM virtio device, 2) Virtio device over vhost-user, 3) Virtio device over Vvu. Each of these scenarios require slightly different policies as a jailed device process needs to allow not only the system calls necessary for the device to function, but also those required by the virtio transport in use. This CL adds a README.md file to the seccomp directory that details the naming and policy inclusion rules, and updates the serial, xhci and coiommu policies to follow the naming scheme. Vhost-user and VVU policy files will be added along with support for jailing devices when they are in use. BUG=b:217480043 TEST=serial device works with `crosvm run`. Change-Id: I6d454aa6e05d00691fe3346e822ed1fc7b24aed8 Signed-off-by: Alexandre Courbot <acourbot@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/3706490 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com>		2022-06-17 04:35:09 +00:00
..
9p_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
balloon_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
battery.policy	seccomp: add getcwd and readlink to common policy for panic	2021-12-02 23:18:03 +00:00
block_device.policy	seccomp: allow newfstatat in more amd64/arm64 policies	2021-10-01 17:09:16 +00:00
coiommu_device.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00
common_device.frequency	seccomp: add frequency file to x86_64	2020-03-19 07:24:56 +00:00
common_device.policy	seccomp: allow clock_gettime in all devices	2022-02-22 23:15:48 +00:00
cras_audio_device.policy	seccomp: allow clock_gettime in all devices	2022-02-22 23:15:48 +00:00
cras_snd_device.policy	seccomp: Add timerfd_* to cras_snd_device.policy	2021-10-11 05:10:11 +00:00
fs_device.policy	seccomp: add getcwd and readlink to common policy for panic	2021-12-02 23:18:03 +00:00
gpu_common.policy	seccomp: Add io_uring_setup / io_uring_enter to gpu_common.policy	2022-05-06 22:09:01 +00:00
gpu_device.policy	gpu: allow syslog from the render server	2021-12-14 16:54:22 +00:00
gpu_render_server.policy	gpu_render_server: allow syslog and signalfd again	2021-12-22 06:01:25 +00:00
input_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
iommu_device.policy	devices: virtio: iommu: enable virtio IOMMU driver	2021-07-09 05:49:26 +00:00
net_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
null_audio_device.policy	audio: Add lseek in null_audio_device policy	2022-05-30 03:20:47 +00:00
pmem_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
rng_device.policy	devices: Update rng devices to be platform agnostic	2022-05-25 01:35:13 +00:00
serial.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00
serial_device.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00
tpm_device.policy	seccomp: use common_device.policy in tpm_device.policy	2022-02-23 19:23:31 +00:00
vfio_device.policy	seccomp: add getcwd and readlink to common policy for panic	2021-12-02 23:18:03 +00:00
vhost_net_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
vhost_vsock_device.policy	Specify prctl's policy only once per device	2021-04-20 22:50:20 +00:00
video_device.policy	seccomp: allow clock_gettime in all devices	2022-02-22 23:15:48 +00:00
vios_audio_device.policy	seccomp: allow clock_gettime in all devices	2022-02-22 23:15:48 +00:00
vvu_proxy_device.policy	crosvm: vvu: proxy: Implement instantiating a VVU proxy device	2022-01-14 04:21:21 +00:00
wl_device.policy	wl: add support for host fences	2021-11-04 01:24:37 +00:00
xhci_device.policy	seccomp: define naming rules for policy files	2022-06-17 04:35:09 +00:00