mirror of
https://chromium.googlesource.com/crosvm/crosvm
synced 2024-11-24 20:48:55 +00:00
38 lines
2.1 KiB
Markdown
38 lines
2.1 KiB
Markdown
|
# Policy files for crosvm
|
||
|
|
|
||
|
|
This folder holds the seccomp policies for crosvm devices, organized by architecture.
|
||
|
|
|
||
|
|
Each crosvm device can run within its owned jailed process. A jailed process is only able to perform
|
||
|
|
the system calls specified in the seccomp policy file the jail has been created with, which improves
|
||
|
|
security as a rogue process cannot perform any system call it wants.
|
||
|
|
|
||
|
|
Each device can run from different contexts, which require a different set of authorized system
|
||
|
|
calls. This file explains how the policy files are named in order to allow these various scenario.
|
||
|
|
|
||
|
|
## Naming conventions
|
||
|
|
|
||
|
|
Since Minijail only allows for one level of policy inclusion, we need to be a little bit creative in
|
||
|
|
order to minimize policy duplication.
|
||
|
|
|
||
|
|
- `common_device.policy` contains a set of syscalls that are common to all devices, and is never
|
||
|
|
loaded directly - only included from other policy files.
|
||
|
|
- `foo.policy` contains the set of syscalls that device `foo` is susceptible to use, regardless of
|
||
|
|
the underlying virtio transport. This policy is also never loaded directly.
|
||
|
|
- `foo_device.policy` is the policy that is loaded when device `foo` is used as an in-VMM (i.e.
|
||
|
|
regular virtio) device. It will generally simply include `common_device.policy` as well as
|
||
|
|
`foo.policy`.
|
||
|
|
|
||
|
|
When using vhost-user, the virtio protocol needs to be sent over a different medium, e.g. a Unix
|
||
|
|
socket. Supporting this transport requires some extra system calls after the device is jailed, and
|
||
|
|
thus dedicated policies:
|
||
|
|
|
||
|
|
- `vhost_user.policy` contains the set of syscalls required by the regular (i.e. socket-based)
|
||
|
|
vhost-user listener. It is never loaded directly.
|
||
|
|
- `vvu.policy` contains the set of syscalls required by the VFIO-based vhost-user (aka
|
||
|
|
Virtio-Vhost-User) listener. It is also never loaded directly.
|
||
|
|
- `foo_device_vhost_user.policy` is the policy that is loaded when device `foo` is used as a regular
|
||
|
|
vhost-user device. It will generally include `common_device.policy`, `vhost_user.policy` and
|
||
|
|
`foo.policy`.
|
||
|
|
- `foo_device_vvu.policy` is the policy that is loaded when device `foo` is used as a VVU device. It
|
||
|
|
will generally include `common_device.policy`, `vvu.policy` and `foo.policy`.
|