diff options
author | Matt Delco <delco@chromium.org> | 2020-02-03 17:26:44 -0800 |
---|---|---|
committer | Commit Bot <commit-bot@chromium.org> | 2020-02-06 17:35:36 +0000 |
commit | 4441c01124a30b7037267fdc74aeee4b6eff111a (patch) | |
tree | d7f219c7299f3a2148e2f858f083d356b12335e3 | |
parent | c65a406abd9d846dfffa9969be6af4e4de97b213 (diff) | |
download | crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.gz crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.bz2 crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.lz crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.xz crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.zst crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.zip |
seccomp: update/cleanup aarch64 rules
The build-time seccomp compiler for aarch64 complains that it doesn't recognize open, epoll_wait, recv, mmap2, dup2, poll, mkdir, or stat. I tried to propose a change to upstream minijail to make it aware of these syscalls, but the calls are in various forms of deprecation so upstream is doubting the sanity of the policy files. I applied the following mapping: open->openat, epoll_wait->epoll_pwait, recv->recvfrom, mmap2->mmap, dup2->dup3, poll->ppoll, mkdir->mkdirat, and stat->statx. In many cases the new syscall was already present so I just deleted the old one. BUG=None TEST=Ran compile_seccomp_policy.py with an unmodified minijail until it stopped complaining. I don't have an arm device for runtime testing. Wrote an app to emulate the execution of the first 400 syscall #s though the bpf filter and verified that the list that matches the filter is the same as the policy file. Change-Id: I599aa549a1712b898eb6b73492872a9676e7215d Signed-off-by: Matt Delco <delco@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2036218 Tested-by: kokoro <noreply+kokoro@google.com> Reviewed-by: Stephen Barber <smbarber@chromium.org>
-rw-r--r-- | seccomp/aarch64/9p_device.policy | 1 | ||||
-rw-r--r-- | seccomp/aarch64/gpu_device.policy | 5 | ||||
-rw-r--r-- | seccomp/aarch64/tpm_device.policy | 13 |
3 files changed, 7 insertions, 12 deletions
diff --git a/seccomp/aarch64/9p_device.policy b/seccomp/aarch64/9p_device.policy index 80bdad8..dcf6ffd 100644 --- a/seccomp/aarch64/9p_device.policy +++ b/seccomp/aarch64/9p_device.policy @@ -2,7 +2,6 @@ # Use of this source code is governed by a BSD-style license that can be # found in the LICENSE file. -open: 1 openat: 1 @include /usr/share/policy/crosvm/common_device.policy diff --git a/seccomp/aarch64/gpu_device.policy b/seccomp/aarch64/gpu_device.policy index 98e15fd..7ef95b2 100644 --- a/seccomp/aarch64/gpu_device.policy +++ b/seccomp/aarch64/gpu_device.policy @@ -11,7 +11,7 @@ dup3: 1 dup: 1 epoll_create1: 1 epoll_ctl: 1 -epoll_wait: 1 +epoll_pwait: 1 eventfd2: 1 exit: 1 exit_group: 1 @@ -28,7 +28,6 @@ ppoll: 1 prctl: arg0 == PR_SET_NAME read: 1 readv: 1 -recv: 1 recvfrom: 1 recvmsg: 1 restart_syscall: 1 @@ -51,6 +50,7 @@ lseek: 1 ftruncate: 1 statx: 1 fstat: 1 +newfstatat: 1 getdents64: 1 # 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali) @@ -59,7 +59,6 @@ ioctl: arg1 & 0x6400 || arg1 & 0x8000 ## mmap/mprotect differ from the common_device.policy mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ -open: return ENOENT openat: 1 ## Rules specific to pvr diff --git a/seccomp/aarch64/tpm_device.policy b/seccomp/aarch64/tpm_device.policy index 7b59c8d..b9bad2e 100644 --- a/seccomp/aarch64/tpm_device.policy +++ b/seccomp/aarch64/tpm_device.policy @@ -6,11 +6,11 @@ brk: 1 clone: arg0 & CLONE_THREAD close: 1 -dup2: 1 +dup3: 1 dup: 1 epoll_create1: 1 epoll_ctl: 1 -epoll_wait: 1 +epoll_pwait: 1 eventfd2: 1 exit: 1 exit_group: 1 @@ -19,17 +19,15 @@ getpid: 1 gettimeofday: 1 kill: 1 madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE -mmap2: arg2 in ~PROT_EXEC +mmap: arg2 in ~PROT_EXEC mprotect: arg2 in ~PROT_EXEC mremap: 1 munmap: 1 nanosleep: 1 pipe2: 1 -poll: 1 ppoll: 1 prctl: arg0 == PR_SET_NAME read: 1 -recv: 1 recvfrom: 1 recvmsg: 1 restart_syscall: 1 @@ -49,8 +47,7 @@ fsync: 1 ftruncate: 1 getuid: 1 lseek: 1 -mkdir: 1 -open: 1 +mkdirat: 1 openat: 1 socket: return EACCES -stat: 1 +statx: 1 |