mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-11-24 20:48:55 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/tests/plugin.policy

56 lines
909 B
Text
Raw Normal View History

Update all copyright headers to match new style This search/replace updates all copyright notices to drop the "All rights reserved", Use "ChromiumOS" instead of "Chromium OS" and drops the trailing dots. This fulfills the request from legal and unifies our notices. ./tools/health-check has been updated to only accept this style. BUG=b:246579983 TEST=./tools/health-check Change-Id: I87a80701dc651f1baf4820e5cc42469d7c5f5bf7 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3894243 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Dennis Kempin <denniskempin@google.com>
2022-09-13 17:55:17 +00:00
# Copyright 2017 The ChromiumOS Authors
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
close: 1
dup: 1
dup2: 1
execve: 1
exit_group: 1
futex: 1
crosvm: pre-cache answers to plugin get calls This change tries to improve the performance of a plugin-based VM by adding a hint API that allows crosvm to proactively push cpu state to the plugin when certain ports for hypercalls are accessed by the VM. BUG=None TEST=build and run. See performance increase significantly. Change-Id: I71af24ebc034095ffea42eedb9ffda0afc719cd6 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1873005 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-09-19 17:30:41 +00:00
kill: 1
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
lseek: 1
tests: Filter args2 in plugin.policy. We don't want mprotect or mmap being called with write and execute at the same time. This policy is for a test, but still filter the arguments incase this policy is used as a starting point elsewhere. BUG=b:172212144 TEST=Kokoro passes Change-Id: I8be82a9af7e404a4eb17f5b2fbb1e6269447de11 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3942708 Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Auto-Submit: Allen Webb <allenwebb@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2022-10-10 19:11:41 +00:00
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
munmap: 1
read: 1
recvfrom: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
clone: arg0 & 0x00010000
tests: plugin: add clone3 and rseq to seccomp policy These syscalls are used by the plugin test child process on newer glibc and kernel versions. Without them, the plugin tests fail because the child processes die with SIGSYS. BUG=None TEST=tools/dev_container tools/presubmit --all Change-Id: Id56831cf146e1e0f24f700744d6db902133ecc62 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4034381 Reviewed-by: Zihan Chen <zihanchen@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-11-17 18:39:12 +00:00
clone3: 1
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
write: 1
eventfd2: 1
poll: 1
getpid: 1
crosvm: pre-cache answers to plugin get calls This change tries to improve the performance of a plugin-based VM by adding a hint API that allows crosvm to proactively push cpu state to the plugin when certain ports for hypercalls are accessed by the VM. BUG=None TEST=build and run. See performance increase significantly. Change-Id: I71af24ebc034095ffea42eedb9ffda0afc719cd6 Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1873005 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-09-19 17:30:41 +00:00
getppid: 1
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
# Allow PR_SET_NAME only.
prctl: arg0 == 15
tests: plugin: add clone3 and rseq to seccomp policy These syscalls are used by the plugin test child process on newer glibc and kernel versions. Without them, the plugin tests fail because the child processes die with SIGSYS. BUG=None TEST=tools/dev_container tools/presubmit --all Change-Id: Id56831cf146e1e0f24f700744d6db902133ecc62 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4034381 Reviewed-by: Zihan Chen <zihanchen@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-11-17 18:39:12 +00:00
rseq: 1
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
access: 1
arch_prctl: 1
brk: 1
exit: 1
fcntl: 1
fstat: 1
ftruncate: 1
getcwd: 1
getrlimit: 1
plugin: add crosvm_net_get_config BUG=none TEST=sudo cargo test --features plugin Change-Id: Ib38fad250295d73529dff0451345b4274a261073 Reviewed-on: https://chromium-review.googlesource.com/911943 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-02-09 23:16:01 +00:00
# TUNGETFEATURES
ioctl: arg1 == 0x800454CF
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
madvise: 1
memfd_create: 1
tests: Filter args2 in plugin.policy. We don't want mprotect or mmap being called with write and execute at the same time. This policy is for a test, but still filter the arguments incase this policy is used as a starting point elsewhere. BUG=b:172212144 TEST=Kokoro passes Change-Id: I8be82a9af7e404a4eb17f5b2fbb1e6269447de11 Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/3942708 Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Auto-Submit: Allen Webb <allenwebb@google.com> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2022-10-10 19:11:41 +00:00
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
open: 1
crosvm: add openat to seccomp This adds openat to a seccomp policy file if open is already there. We need this because glibc 2.25 changed it system call for open(). BUG=chromium:894614 TEST=None Change-Id: Ie5b45d858e8d9ea081fd7bfda81709bda048d965 Reviewed-on: https://chromium-review.googlesource.com/1292129 Commit-Ready: Yunlian Jiang <yunlian@chromium.org> Tested-by: Yunlian Jiang <yunlian@chromium.org> Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
2018-10-19 19:04:45 +00:00
openat: 1
crosvm: add getpid and prlimit to seccomp This is needed to make sure seccomp work with glibc 2.27 BUG=chromium:897477 TEST=None Change-Id: I101aa07bffd8db2b449be1a697dafcd7d6f1cb58 Reviewed-on: https://chromium-review.googlesource.com/1294729 Commit-Ready: Yunlian Jiang <yunlian@chromium.org> Tested-by: Yunlian Jiang <yunlian@chromium.org> Reviewed-by: Mike Frysinger <vapier@chromium.org>
2018-10-22 20:20:34 +00:00
prlimit64: arg2 == 0 && arg3 != 0
crosvm: run plugin process in a jail by default The plugin process is similar to a virtual device from the perspective of crosvm. Therefore, the plugin process should be run in a jail, similar to the other devices in crosvm. TEST=cargo build --features plugin; ./build_test BUG=chromium:800626 Change-Id: I881d7b0f8a11e2626f69a5fa0eee0aa59bb6b6be Reviewed-on: https://chromium-review.googlesource.com/882131 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-01-24 05:16:42 +00:00
recvmsg: 1
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
sendmsg: 1
set_tid_address: 1
stat: 1
writev: 1
Reference in a new issue Copy permalink