crosvm/seccomp/x86_64/gpu_device.policy
Adrian Ratiu f19933bfb0 tree-wide: seccomp: allow clock_nanosleep syscalls
Starting with 2.32 glibc nanosleep() was refactored to use the
clock_nanosleep syscall so various software will fail unless
the new syscall is allowed. We can't just drop the old nanosleep
syscall because it will break glibc 2.27 which is still used.

See glibc commits:
807edded25 nptl: Refactor thrd_sleep in terms of clock_nanosleep
3537ecb49c Refactor nanosleep in terms of clock_nanosleep
79a547b162 nptl: Move nanosleep implementation to libc

This is a bulk edit done with the following command:
git grep -rl 'nanosleep: 1' | xargs sed -i \
                           '/^nanosleep: 1/a clock_nanosleep: 1'

BUG=chromium:1171287
TEST=Local builds and booting on kevin/64/eve/minnie.

Change-Id: I975535078d88200f52319c7eea3a4c7ebf299933
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2735575
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Manoj Gupta <manojgupta@chromium.org>
Commit-Queue: Manoj Gupta <manojgupta@chromium.org>
Reviewed-by: Dylan Reid <dgreid@chromium.org>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-07 01:53:10 +00:00

103 lines
2.2 KiB
Text

# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
# Rules from common_device.policy with some rules removed because they block certain flags needed
# for gpu.
brk: 1
clock_gettime: 1
clone: arg0 & CLONE_THREAD
close: 1
dup2: 1
dup: 1
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
eventfd2: 1
exit: 1
exit_group: 1
futex: 1
getpid: 1
gettid: 1
gettimeofday: 1
kill: 1
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
mremap: 1
munmap: 1
nanosleep: 1
clock_nanosleep: 1
pipe2: 1
poll: 1
ppoll: 1
prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
read: 1
readv: 1
recvfrom: 1
recvmsg: 1
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
rt_sigreturn: 1
sched_getaffinity: 1
sendmsg: 1
sendto: 1
set_robust_list: 1
sigaltstack: 1
write: 1
writev: 1
# Rules specific to gpu
connect: 1
fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_SETFD || arg1 == F_GETFL || \
arg1 == F_SETFL
fstat: 1
# Used to set of size new memfd.
ftruncate: 1
getdents: 1
geteuid: 1
getrandom: 1
getuid: 1
ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400
lseek: 1
lstat: 1
# Used for sharing memory with wayland. Also internally by Intel anv.
# arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING or simply MFD_CLOEXEC.
memfd_create: arg1 == 3 || arg1 == 1
# mmap/mprotect/open/openat differ from the common_device.policy
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
open: 1
openat: 1
readlink: 1
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
stat: 1
statx: 1
sysinfo: 1
# Required for perfetto tracing
# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
getsockopt: 1
shutdown: 1
# Rules for Mesa's shader binary cache.
flock: 1
mkdir: 1
newfstatat: 1
rename: 1
setpriority: 1
unlink: 1
# Rules specific to AMD gpus.
uname: 1
sched_setscheduler: 1
sched_setaffinity: 1
kcmp: 1
# Rules for Vulkan loader
access: 1
getgid: 1
getegid: 1
# Rules for virglrenderer
sched_yield: 1