crosvm/seccomp/aarch64/9p_device.policy
Yusuke Sato 1617c21918 seccomp: Allow 9p device to use open/openat
This allows us to use export a directory to a VM with the
'--shared-dir tag:/dir' crosvm command line flag without relying
on seneschal. The fs device's policy already does the same.

BUG=b:123309049
TEST=Start tot ARCVM, run 'mkdir /var/run/arc/arcvm && mount -t 9p
  -o "trans=virtio,version=9p2000.L,cache=none,access=any"
  host_generated /var/run/arc/arcvm && ls /var/run/arc/arcvm',
  verify ls prints files.

Change-Id: I8f8b265fc8a7de159508afbee5114b6a3f084d01
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1995319
Tested-by: Yusuke Sato <yusukes@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Lepton Wu <lepton@chromium.org>
Reviewed-by: Chirantan Ekbote <chirantan@chromium.org>
Commit-Queue: Yusuke Sato <yusukes@chromium.org>
2020-01-13 21:26:19 +00:00

28 lines
519 B
Text

# Copyright 2019 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
open: 1
openat: 1
@include /usr/share/policy/crosvm/common_device.policy
pread64: 1
pwrite64: 1
statx: 1
fstat: 1
ioctl: arg1 == FIOCLEX
getdents64: 1
fdatasync: 1
fsync: 1
mkdirat: 1
renameat: 1
writev: 1
linkat: 1
unlinkat: 1
socket: arg0 == AF_UNIX
utimensat: 1
ftruncate: 1
fchown: arg1 == 0xffffffff && arg2 == 0xffffffff
statfs: 1
newfstatat: 1