diff options
| author | David Riley <davidriley@chromium.org> | 2019-07-24 17:22:50 -0700 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2019-08-01 19:34:05 +0000 |
| commit | 54e660ba8b912cf9c1fe7837cd42d21b9cfe9133 (patch) | |
| tree | c6f773579a1e00b4b27c92848db2a711906026ed /seccomp | |
| parent | 06787c5b6c0d1d878d7cef5f9fbdb14813c5e80c (diff) | |
| download | crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.tar crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.tar.gz crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.tar.bz2 crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.tar.lz crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.tar.xz crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.tar.zst crosvm-54e660ba8b912cf9c1fe7837cd42d21b9cfe9133.zip | |
gpu: Add sandboxing support for pvr.
BUG=chromium:892280 TEST=glxgears with virtio-gpu on hana Change-Id: Ib92b21c124e30eacb3fc28558e2eb5d8d4a92567 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1717739 Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: David Riley <davidriley@chromium.org> Commit-Queue: David Riley <davidriley@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org> Auto-Submit: David Riley <davidriley@chromium.org>
Diffstat (limited to 'seccomp')
| -rw-r--r-- | seccomp/arm/gpu_device.policy | 11 |
1 files changed, 11 insertions, 0 deletions
diff --git a/seccomp/arm/gpu_device.policy b/seccomp/arm/gpu_device.policy index 2e3e1ba..bcd29b6 100644 --- a/seccomp/arm/gpu_device.policy +++ b/seccomp/arm/gpu_device.policy @@ -44,6 +44,7 @@ sendto: 1 set_robust_list: 1 sigaltstack: 1 write: 1 +writev: 1 ## Rules specific to gpu connect: 1 @@ -62,3 +63,13 @@ ioctl: arg1 & 0x6400 || arg1 & 0x8000 ## mmap/mprotect/open/openat differ from the common_device.policy mmap2: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ + +## Rules specific to pvr +geteuid32: 1 +getuid32: 1 +lstat64: 1 +readlink: 1 +gettid: 1 +fcntl64: 1 +tgkill: 1 +clock_gettime: 1 |