summary refs log tree commit diff
diff options
context:
space:
mode:
authorMatt Delco <delco@chromium.org>2020-02-03 17:26:44 -0800
committerCommit Bot <commit-bot@chromium.org>2020-02-06 17:35:36 +0000
commit4441c01124a30b7037267fdc74aeee4b6eff111a (patch)
treed7f219c7299f3a2148e2f858f083d356b12335e3
parentc65a406abd9d846dfffa9969be6af4e4de97b213 (diff)
downloadcrosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar
crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.gz
crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.bz2
crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.lz
crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.xz
crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.tar.zst
crosvm-4441c01124a30b7037267fdc74aeee4b6eff111a.zip
seccomp: update/cleanup aarch64 rules
The build-time seccomp compiler for aarch64 complains that it doesn't
recognize open, epoll_wait, recv, mmap2, dup2, poll, mkdir, or stat.

I tried to propose a change to upstream minijail to make it aware of
these syscalls, but the calls are in various forms of deprecation
so upstream is doubting the sanity of the policy files.

I applied the following mapping: open->openat, epoll_wait->epoll_pwait,
recv->recvfrom, mmap2->mmap, dup2->dup3, poll->ppoll, mkdir->mkdirat,
and stat->statx.  In many cases the new syscall was already present so I
just deleted the old one.

BUG=None
TEST=Ran compile_seccomp_policy.py with an unmodified minijail until
it stopped complaining.  I don't have an arm device for runtime testing.
Wrote an app to emulate the execution of the first 400 syscall #s though
the bpf filter and verified that the list that matches the filter is the
same as the policy file.

Change-Id: I599aa549a1712b898eb6b73492872a9676e7215d
Signed-off-by: Matt Delco <delco@chromium.org>
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/2036218
Tested-by: kokoro <noreply+kokoro@google.com>
Reviewed-by: Stephen Barber <smbarber@chromium.org>
-rw-r--r--seccomp/aarch64/9p_device.policy1
-rw-r--r--seccomp/aarch64/gpu_device.policy5
-rw-r--r--seccomp/aarch64/tpm_device.policy13
3 files changed, 7 insertions, 12 deletions
diff --git a/seccomp/aarch64/9p_device.policy b/seccomp/aarch64/9p_device.policy
index 80bdad8..dcf6ffd 100644
--- a/seccomp/aarch64/9p_device.policy
+++ b/seccomp/aarch64/9p_device.policy
@@ -2,7 +2,6 @@
 # Use of this source code is governed by a BSD-style license that can be
 # found in the LICENSE file.
 
-open: 1
 openat: 1
 
 @include /usr/share/policy/crosvm/common_device.policy
diff --git a/seccomp/aarch64/gpu_device.policy b/seccomp/aarch64/gpu_device.policy
index 98e15fd..7ef95b2 100644
--- a/seccomp/aarch64/gpu_device.policy
+++ b/seccomp/aarch64/gpu_device.policy
@@ -11,7 +11,7 @@ dup3: 1
 dup: 1
 epoll_create1: 1
 epoll_ctl: 1
-epoll_wait: 1
+epoll_pwait: 1
 eventfd2: 1
 exit: 1
 exit_group: 1
@@ -28,7 +28,6 @@ ppoll: 1
 prctl: arg0 == PR_SET_NAME
 read: 1
 readv: 1
-recv: 1
 recvfrom: 1
 recvmsg: 1
 restart_syscall: 1
@@ -51,6 +50,7 @@ lseek: 1
 ftruncate: 1
 statx: 1
 fstat: 1
+newfstatat: 1
 getdents64: 1
 
 # 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali)
@@ -59,7 +59,6 @@ ioctl: arg1 & 0x6400 || arg1 & 0x8000
 ## mmap/mprotect differ from the common_device.policy
 mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
 mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
-open: return ENOENT
 openat: 1
 
 ## Rules specific to pvr
diff --git a/seccomp/aarch64/tpm_device.policy b/seccomp/aarch64/tpm_device.policy
index 7b59c8d..b9bad2e 100644
--- a/seccomp/aarch64/tpm_device.policy
+++ b/seccomp/aarch64/tpm_device.policy
@@ -6,11 +6,11 @@
 brk: 1
 clone: arg0 & CLONE_THREAD
 close: 1
-dup2: 1
+dup3: 1
 dup: 1
 epoll_create1: 1
 epoll_ctl: 1
-epoll_wait: 1
+epoll_pwait: 1
 eventfd2: 1
 exit: 1
 exit_group: 1
@@ -19,17 +19,15 @@ getpid: 1
 gettimeofday: 1
 kill: 1
 madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
-mmap2: arg2 in ~PROT_EXEC
+mmap: arg2 in ~PROT_EXEC
 mprotect: arg2 in ~PROT_EXEC
 mremap: 1
 munmap: 1
 nanosleep: 1
 pipe2: 1
-poll: 1
 ppoll: 1
 prctl: arg0 == PR_SET_NAME
 read: 1
-recv: 1
 recvfrom: 1
 recvmsg: 1
 restart_syscall: 1
@@ -49,8 +47,7 @@ fsync: 1
 ftruncate: 1
 getuid: 1
 lseek: 1
-mkdir: 1
-open: 1
+mkdirat: 1
 openat: 1
 socket: return EACCES
-stat: 1
+statx: 1