mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-12-04 06:33:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/x86_64/gpu_device.policy

64 lines
1.6 KiB
Text
Raw Normal View History

gpu: add sandboxing via minijail for virtio gpu device. Sandboxing only works when started as chronos via concierge client. If started directly via crosvm as root, the jail will not have proper group permissions to access the Wayland socket. BUG=chromium:837073 TEST=build with --features=gpu; null_platform_test without --disable-sandbox CQ-DEPEND=CL:1213779 Change-Id: I6331f7ae1f5b99d31ad44cf158f72337294771f0 Reviewed-on: https://chromium-review.googlesource.com/1181168 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-08-20 15:11:42 +00:00
# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
open: 1
crosvm: add openat to seccomp This adds openat to a seccomp policy file if open is already there. We need this because glibc 2.25 changed it system call for open(). BUG=chromium:894614 TEST=None Change-Id: Ie5b45d858e8d9ea081fd7bfda81709bda048d965 Reviewed-on: https://chromium-review.googlesource.com/1292129 Commit-Ready: Yunlian Jiang <yunlian@chromium.org> Tested-by: Yunlian Jiang <yunlian@chromium.org> Reviewed-by: Manoj Gupta <manojgupta@chromium.org>
2018-10-19 19:04:45 +00:00
openat: 1
gpu: add sandboxing via minijail for virtio gpu device. Sandboxing only works when started as chronos via concierge client. If started directly via crosvm as root, the jail will not have proper group permissions to access the Wayland socket. BUG=chromium:837073 TEST=build with --features=gpu; null_platform_test without --disable-sandbox CQ-DEPEND=CL:1213779 Change-Id: I6331f7ae1f5b99d31ad44cf158f72337294771f0 Reviewed-on: https://chromium-review.googlesource.com/1181168 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Reviewed-by: Jorge Lucangeli Obes <jorgelo@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2018-08-20 15:11:42 +00:00
close: 1
sigaltstack: 1
munmap: 1
write: 1
# Allow mmap to allow loading of GL shared libraries.
mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC
restart_syscall: 1
exit_group: 1
rt_sigreturn: 1
# Allow MADV_DONTDUMP only.
madvise: arg2 == MADV_DONTDUMP || arg2 == MADV_DONTNEED
# Used to determine shm size after recvmsg with fd.
lseek: 1
mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
sched_getaffinity: 1
set_robust_list: 1
exit: 1
getpid: 1
recvfrom: 1
dup: 1
eventfd2: 1
futex: 1
# Disallow clone's other than new threads.
# arg0 is flags. Because kernel.
clone: arg0 & 0x00010000
# arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == DMA_BUF_IOCTL_SYNC ||
# arg1 & DRM_IOCTL
ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400
fstat: 1
# Used to communicate with wayland.
recvmsg: 1
sendmsg: 1
poll: 1
getrandom: 1
read: 1
geteuid: 1
getuid: 1
readlink: 1
getdents: 1
stat: 1
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
# Used to connect to wayland.
# arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
connect: 1
# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
memfd_create: arg1 == 3
# Used to set of size new memfd.
ftruncate: 1
fcntl: arg1 == F_DUPFD_CLOEXEC
devices: gpu: add lstat to gpu device seccomp BUG=chromium:837073 TEST=vmc start --enable-gpu tatl; lxc start stretch-x; xterm && glxgears Change-Id: I42a096384cb536ec835de69b34db9b9a941bfeaf Reviewed-on: https://chromium-review.googlesource.com/1401110 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-01-08 20:28:24 +00:00
lstat: 1
devices: gpu: name gpu thread BUG=chromium:925590 TEST=pstree Change-Id: I2f591894db2a40a812f1720e1fc8422049d85902 Reviewed-on: https://chromium-review.googlesource.com/1440031 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: David Riley <davidriley@chromium.org>
2019-01-28 19:25:10 +00:00
# Allow PR_SET_NAME only.
prctl: arg0 == 15
devices: gpu: dup stdout to stderr to allow virglrenderer logging By default virglrenderer logs to stderr with VREND_DEBUG. dup stdout which is logged via logger to stderr so that virglrenderer logs can be seen. BUG=chromium:925590 TEST=cat /var/log/messages Change-Id: I3e1a5056dab9cfd895867b1835b421b144ee536b Reviewed-on: https://chromium-review.googlesource.com/1441352 Commit-Ready: David Riley <davidriley@chromium.org> Tested-by: David Riley <davidriley@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Zach Reizner <zachr@chromium.org>
2019-01-29 00:59:18 +00:00
dup2: 1
devices: gpu: allow brk syscall BUG=chromium:926415 TEST=start Tomb Raider Change-Id: I55352a84a4edd03337f262e1474e0888abfc8c81 Reviewed-on: https://chromium-review.googlesource.com/1446939 Commit-Ready: ChromeOS CL Exonerator Bot <chromiumos-cl-exonerator@appspot.gserviceaccount.com> Tested-by: David Riley <davidriley@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: David Riley <davidriley@chromium.org>
2019-01-30 21:41:12 +00:00
brk: 1
Reference in a new issue Copy permalink