mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-12-04 06:33:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/x86_64/block_device.policy

30 lines
655 B
Text
Raw Normal View History

Put seccomp policy files in a common directory We will almost certainly require different seccomp policy files for different architectures. Move all the existing secommp policy files into a common directory grouped by architecture. This will make it easier to install them via the ebuild later. BUG=none TEST=none Change-Id: I0495789cd4143dc374ee6ebe083dc20ce724edbb Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/630058 Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2017-08-23 18:20:36 +00:00
# Copyright 2017 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
crosvm: Put block device process in a minijail Run with the new seccomp filter and drop all capabilities. In addition enter a new user, mount, network, and ipc namespace. Leave the mount namespace empty after pivot-rooting to an empty directory. Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/515603
2017-05-12 23:15:53 +00:00
close: 1
Add ability to minijail_fork Change-Id: I0c774816067449cbb838dcf29c6fa947ae5916e1 Reviewed-on: https://chromium-review.googlesource.com/719442 Commit-Ready: Dylan Reid <dgreid@chromium.org> Tested-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2017-09-26 20:49:42 +00:00
dup: 1
dup2: 1
crosvm: Put block device process in a minijail Run with the new seccomp filter and drop all capabilities. In addition enter a new user, mount, network, and ipc namespace. Leave the mount namespace empty after pivot-rooting to an empty directory. Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/515603
2017-05-12 23:15:53 +00:00
exit_group: 1
futex: 1
lseek: 1
# Disallow mmap with PROT_EXEC set. The syntax here doesn't allow bit
# negation, thus the manually negated mask constant.
mmap: arg2 in 0xfffffffb
mprotect: arg2 in 0xfffffffb
munmap: 1
read: 1
recvfrom: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
clone: arg0 & 0x00010000
write: 1
eventfd2: 1
poll: 1
sys_util: use libc's openlog to connect to syslog By using libc's openlog, we can ensure that the internal state of the libc syslogger is consistent with the syslog module. Minijail will be able to print to stderr and the syslog in the same way the logging macros in crosvm do. The FD the syslog module uses is shared with libc and via `syslog::get_fds`, jailed processes can inherit the needed FDs to continue logging. Now that `sys_log::init()` must be called in single threaded process, this moves its tests to the list of the serially run ones in build_test.py. TEST=./build_test BUG=None Change-Id: I8dbc8ebf9d97ef670185259eceac5f6d3d6824ea Reviewed-on: https://chromium-review.googlesource.com/649951 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Jason Clinton <jclinton@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2017-09-04 22:59:08 +00:00
getpid: 1
crosvm/devices: set thread names crosvm spawns a lot of processes/threads, and having these all use the same name as the original process can be confusing. So at least in the instances where Rust threads are spawned (vs. minijail_fork()), use a thread::Builder to allow setting the thread name. BUG=none TEST=start crosvm, check thread names with top Change-Id: I6e55ff5fd60f258880bda8e656ab7f9da82c656e Reviewed-on: https://chromium-review.googlesource.com/742394 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2017-10-30 06:13:48 +00:00
# Allow PR_SET_NAME only.
prctl: arg0 == 15
crosvm: don't die on suspend/resume Suspend/resume can cause syscall restarts and will cause KVM_RUN ioctls to return with EINTR. Handle these so the VM doesn't shut down. BUG=none TEST=vm survives suspend/resume Change-Id: I1fab624cb8fe0949d341408f0c962c859a034205 Reviewed-on: https://chromium-review.googlesource.com/750054 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2017-11-02 02:05:29 +00:00
restart_syscall: 1
Reference in a new issue Copy permalink