mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-11-28 17:44:10 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/arm/tpm_device.policy

66 lines
1 KiB
Text
Raw Normal View History

tpm: Virtio tpm device This CL adds a "tpm" Cargo cfg to crosvm which enables a TPM device backed by libtpm2 simulator. Tested by running the following inside cros_sdk: LIBRARY_PATH=~/src/minijail LD_LIBRARY_PATH=~/src/minijail \ cargo run --release \ --features tpm \ -- \ run \ -r rootfs.ext4 \ --seccomp-policy-dir seccomp/x86_64/ \ -p init=/bin/bash \ -p panic=-1 \ --disable-sandbox \ vmlinux.bin with a Linux image built from CL:1387655. The TPM self test completes successfully with the following output: https://paste.googleplex.com/5996075978588160?raw Justin's TPM playground runs with the following trace output. https://paste.googleplex.com/4909751007707136?raw Design doc: go/vtpm-for-glinux TEST=ran TPM playground program inside crosvm TEST=local kokoro BUG=chromium:911799 Change-Id: I2feb24a3e38cba91f62c6d2cd1f378de4dd03ecf Reviewed-on: https://chromium-review.googlesource.com/1387624 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2018-12-20 19:49:46 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
# common policy
brk: 1
crosvm: add more time syscalls to policies glibc 2.32 is using clock_gettime/64 on some arm boards when gettimeofday is used. In addition, support 64-bit variants of the time syscalls for use with glibc 2.32. BUG=chromium:1190305 TEST=crostini tests pass Change-Id: I070eee92817d3f959ea385ff2c3adca610e0a574 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2776211 Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-19 19:57:19 +00:00
clock_gettime: 1
clock_gettime64: 1
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
clone: arg0 & CLONE_THREAD
close: 1
dup2: 1
dup: 1
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
eventfd2: 1
exit: 1
exit_group: 1
futex: 1
crosvm: add more time syscalls to policies glibc 2.32 is using clock_gettime/64 on some arm boards when gettimeofday is used. In addition, support 64-bit variants of the time syscalls for use with glibc 2.32. BUG=chromium:1190305 TEST=crostini tests pass Change-Id: I070eee92817d3f959ea385ff2c3adca610e0a574 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2776211 Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-19 19:57:19 +00:00
futex_time64: 1
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
getpid: 1
tpm: Update libtpm2 to master The git submodule needs to be updated to work with newer chroot libssl. In addition, the new OpenSSL version uses the getrandom syscall, so it needs to be added to the seccomp policies. TEST=build_test works again, vm's boot with a --software-tpm Change-Id: Ie3242e9fa4dba42bf6266e674f987d8c9dbc1dbe Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2316380 Reviewed-by: Daniel Verkamp <dverkamp@chromium.org> Tested-by: Daniel Verkamp <dverkamp@chromium.org> Commit-Queue: Dylan Reid <dgreid@chromium.org>
2020-07-23 18:28:57 +00:00
getrandom: 1
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
gettimeofday: 1
kill: 1
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
mmap2: arg2 in ~PROT_EXEC
mprotect: arg2 in ~PROT_EXEC
mremap: 1
munmap: 1
nanosleep: 1
tree-wide: seccomp: allow clock_nanosleep syscalls Starting with 2.32 glibc nanosleep() was refactored to use the clock_nanosleep syscall so various software will fail unless the new syscall is allowed. We can't just drop the old nanosleep syscall because it will break glibc 2.27 which is still used. See glibc commits: 807edded25 nptl: Refactor thrd_sleep in terms of clock_nanosleep 3537ecb49c Refactor nanosleep in terms of clock_nanosleep 79a547b162 nptl: Move nanosleep implementation to libc This is a bulk edit done with the following command: git grep -rl 'nanosleep: 1' | xargs sed -i \ '/^nanosleep: 1/a clock_nanosleep: 1' BUG=chromium:1171287 TEST=Local builds and booting on kevin/64/eve/minnie. Change-Id: I975535078d88200f52319c7eea3a4c7ebf299933 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2735575 Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2021-03-04 13:29:55 +00:00
clock_nanosleep: 1
crosvm: add more time syscalls to policies glibc 2.32 is using clock_gettime/64 on some arm boards when gettimeofday is used. In addition, support 64-bit variants of the time syscalls for use with glibc 2.32. BUG=chromium:1190305 TEST=crostini tests pass Change-Id: I070eee92817d3f959ea385ff2c3adca610e0a574 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2776211 Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-19 19:57:19 +00:00
clock_nanosleep_time64: 1
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
pipe2: 1
poll: 1
ppoll: 1
crosvm: add more time syscalls to policies glibc 2.32 is using clock_gettime/64 on some arm boards when gettimeofday is used. In addition, support 64-bit variants of the time syscalls for use with glibc 2.32. BUG=chromium:1190305 TEST=crostini tests pass Change-Id: I070eee92817d3f959ea385ff2c3adca610e0a574 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2776211 Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-19 19:57:19 +00:00
ppoll_time64: 1
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
prctl: arg0 == PR_SET_NAME
read: 1
recv: 1
recvfrom: 1
recvmsg: 1
crosvm: add more time syscalls to policies glibc 2.32 is using clock_gettime/64 on some arm boards when gettimeofday is used. In addition, support 64-bit variants of the time syscalls for use with glibc 2.32. BUG=chromium:1190305 TEST=crostini tests pass Change-Id: I070eee92817d3f959ea385ff2c3adca610e0a574 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2776211 Commit-Queue: Manoj Gupta <manojgupta@chromium.org> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org> Tested-by: Manoj Gupta <manojgupta@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Auto-Submit: Manoj Gupta <manojgupta@chromium.org> Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>
2021-03-19 19:57:19 +00:00
recvmmsg_time64: 1
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
rt_sigreturn: 1
sched_getaffinity: 1
sendmsg: 1
set_robust_list: 1
sigaltstack: 1
write: 1
# tpm-specific policy
chdir: 1
fstat: 1
fsync: 1
ftruncate: 1
getuid: 1
lseek: 1
mkdir: 1
open: 1
openat: 1
seccomp: return error from socket for TPM device The crosvm TPM process calls ssleay_rand_bytes(), which in some cases attempts to acquire entropy through an EGD ("entropy gathering daemon") - see OpenSSL's RAND_query_egd_bytes(). Attempting to communicate with this daemon by creating a socket would cause the process to exit currently because the syscall whitelist did not allow socket() or connect(). Since we don't have an EGD and don't want to expose it to the sandboxed TPM process anyway, modify the TPM seccomp policy to cause socket() to return an error rather than aborting. BUG=None TEST=`vmc start --software-tpm termina` Change-Id: Ib7c6bceced0f6cbe7199614ece8446aa300cec1e Signed-off-by: Daniel Verkamp <dverkamp@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1684411 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Vadim Sukhomlinov <sukhomlinov@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-05-16 18:14:00 +00:00
socket: return EACCES
tpm: Update tpm device policy to support libtpm2 Tested by running the following on a grunt board (Barla) in dev mode together with CL:1496910: sudo crosvm run \ --root rootfs.ext4 \ --socket crosvm.sock \ --seccomp-policy-dir seccomp \ --software-tpm \ -p init=/bin/bash \ -p panic=-1 \ vmlinux.bin and confirming that /dev/tpm0 and /dev/tpmrm0 are present in the VM. I needed to override the common device policy's `open` and `openat` and was not able to get that working with the existing @include. Note: untested on arm. BUG=chromium:921841 TEST=manual testing on grunt Change-Id: Ied7f18a631ce8c0ae280f8b6c01511ca20c3d1c8 Reviewed-on: https://chromium-review.googlesource.com/1496909 Commit-Ready: David Tolnay <dtolnay@chromium.org> Tested-by: David Tolnay <dtolnay@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-03-02 00:13:27 +00:00
stat: 1
seccomp: allow statx syscall where stat/fstat was allowed This is used in Rust 1.40.0's libstd in place of stat/fstat; update the whitelists to allow the new syscall as well. BUG=chromium:1042461 TEST=`crosvm disk resize` does not trigger seccomp failure Change-Id: Ia3f0e49ee009547295c7af7412dfb5eb3ac1efcb Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2003685 Reviewed-by: Chirantan Ekbote <chirantan@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2020-01-15 21:34:09 +00:00
statx: 1
Reference in a new issue Copy permalink