mirrors/crosvm
1
0
Fork 0
mirror of https://chromium.googlesource.com/crosvm/crosvm synced 2024-12-04 06:33:54 +00:00
Code Issues Projects Releases Packages Wiki Activity Actions
crosvm/seccomp/x86_64/block_device.policy

37 lines
785 B
Text
Raw Normal View History

Put seccomp policy files in a common directory We will almost certainly require different seccomp policy files for different architectures. Move all the existing secommp policy files into a common directory grouped by architecture. This will make it easier to install them via the ebuild later. BUG=none TEST=none Change-Id: I0495789cd4143dc374ee6ebe083dc20ce724edbb Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/630058 Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2017-08-23 18:20:36 +00:00
# Copyright 2017 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
crosvm: Put block device process in a minijail Run with the new seccomp filter and drop all capabilities. In addition enter a new user, mount, network, and ipc namespace. Leave the mount namespace empty after pivot-rooting to an empty directory. Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/515603
2017-05-12 23:15:53 +00:00
close: 1
Add ability to minijail_fork Change-Id: I0c774816067449cbb838dcf29c6fa947ae5916e1 Reviewed-on: https://chromium-review.googlesource.com/719442 Commit-Ready: Dylan Reid <dgreid@chromium.org> Tested-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2017-09-26 20:49:42 +00:00
dup: 1
dup2: 1
crosvm: Put block device process in a minijail Run with the new seccomp filter and drop all capabilities. In addition enter a new user, mount, network, and ipc namespace. Leave the mount namespace empty after pivot-rooting to an empty directory. Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/515603
2017-05-12 23:15:53 +00:00
exit_group: 1
main: Allow qcow files to be used as disks Using qcow to allow for growable disk. These will be used for user data. Change-Id: Iefb54eb4255db2ea7693db0020c5f1429acd73fd Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/862629 Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-01-11 17:20:16 +00:00
fstat: 1
ftruncate: 1
crosvm: Put block device process in a minijail Run with the new seccomp filter and drop all capabilities. In addition enter a new user, mount, network, and ipc namespace. Leave the mount namespace empty after pivot-rooting to an empty directory. Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/515603
2017-05-12 23:15:53 +00:00
futex: 1
lseek: 1
# Disallow mmap with PROT_EXEC set. The syntax here doesn't allow bit
# negation, thus the manually negated mask constant.
mmap: arg2 in 0xfffffffb
mprotect: arg2 in 0xfffffffb
sys_util: use MADV_DONTDUMP for new mmaps The mmaps made through the sys_util API are usually for guest memory or other large shared memory chunks that will pollute the file system with huge dumps on crash. By using MADV_DONTDUMP, we save the file system from storing these useless data segments when crosvm crashes. TEST=./build_test BUG=None Change-Id: I2041523648cd7c150bbdbfceef589f42d3f9c2b9 Reviewed-on: https://chromium-review.googlesource.com/890279 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-01-27 01:37:57 +00:00
# Allow MADV_DONTDUMP only.
madvise: arg2 == 0x00000010
crosvm: Put block device process in a minijail Run with the new seccomp filter and drop all capabilities. In addition enter a new user, mount, network, and ipc namespace. Leave the mount namespace empty after pivot-rooting to an empty directory. Change-Id: Iee583cf260ede8ca13f005836684eb80c2c3ac3e Signed-off-by: Dylan Reid <dgreid@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/515603
2017-05-12 23:15:53 +00:00
munmap: 1
read: 1
recvfrom: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
clone: arg0 & 0x00010000
write: 1
eventfd2: 1
poll: 1
sys_util: add ppoll to seccomp policies This really should have been added along with the poll timeout support, which changed the syscalls used in every jailed device. TEST=run crosvm with sandboxing enabled BUG=None Change-Id: I6129fa589640bb2b85fb4274775192bdd49db672 Reviewed-on: https://chromium-review.googlesource.com/890379 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2018-01-27 05:21:37 +00:00
ppoll: 1
sys_util: use libc's openlog to connect to syslog By using libc's openlog, we can ensure that the internal state of the libc syslogger is consistent with the syslog module. Minijail will be able to print to stderr and the syslog in the same way the logging macros in crosvm do. The FD the syslog module uses is shared with libc and via `syslog::get_fds`, jailed processes can inherit the needed FDs to continue logging. Now that `sys_log::init()` must be called in single threaded process, this moves its tests to the list of the serially run ones in build_test.py. TEST=./build_test BUG=None Change-Id: I8dbc8ebf9d97ef670185259eceac5f6d3d6824ea Reviewed-on: https://chromium-review.googlesource.com/649951 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Jason Clinton <jclinton@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
2017-09-04 22:59:08 +00:00
getpid: 1
crosvm/devices: set thread names crosvm spawns a lot of processes/threads, and having these all use the same name as the original process can be confusing. So at least in the instances where Rust threads are spawned (vs. minijail_fork()), use a thread::Builder to allow setting the thread name. BUG=none TEST=start crosvm, check thread names with top Change-Id: I6e55ff5fd60f258880bda8e656ab7f9da82c656e Reviewed-on: https://chromium-review.googlesource.com/742394 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
2017-10-30 06:13:48 +00:00
# Allow PR_SET_NAME only.
prctl: arg0 == 15
crosvm: don't die on suspend/resume Suspend/resume can cause syscall restarts and will cause KVM_RUN ioctls to return with EINTR. Handle these so the VM doesn't shut down. BUG=none TEST=vm survives suspend/resume Change-Id: I1fab624cb8fe0949d341408f0c962c859a034205 Reviewed-on: https://chromium-review.googlesource.com/750054 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
2017-11-02 02:05:29 +00:00
restart_syscall: 1
devices: block: use PollContext in block device Switching to PollContext so that there is one less user of Poller, which will be removed. TEST=run any vm with a block device BUG=chromium:816692 Change-Id: I2e1301ea9d66012262f1fcb69eaeee9f7464f3b3 Reviewed-on: https://chromium-review.googlesource.com/983036 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
2018-03-28 09:19:33 +00:00
epoll_create1: 1
epoll_ctl: 1
epoll_wait: 1
Reference in a new issue Copy permalink