diff options
| author | Gurchetan Singh <gurchetansingh@chromium.org> | 2019-06-21 10:19:29 -0700 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2019-07-03 15:41:58 +0000 |
| commit | ad656a9d3adad4c5cf682290f7fcc146df7d6b9d (patch) | |
| tree | 08cf13b30b4290b62e2c89de41b6e83ea762c508 /seccomp | |
| parent | 996beb6499ad9f9cb2d8a8f88f8cfdb6ea88d764 (diff) | |
| download | crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.tar crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.tar.gz crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.tar.bz2 crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.tar.lz crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.tar.xz crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.tar.zst crosvm-ad656a9d3adad4c5cf682290f7fcc146df7d6b9d.zip | |
seccomp: whitelist read-only/write-only GPU mappings
minigbm sometimes maps buffer with only PROT_READ or only PROT_WRITE, so allow this. BUG=b:132939420 TEST=glxgears in container Change-Id: Ie5ccd827dd14ee78b999d70287b7165d81c5c85e Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1673533 Tested-by: kokoro <noreply+kokoro@google.com> Tested-by: Gurchetan Singh <gurchetansingh@chromium.org> Commit-Queue: Gurchetan Singh <gurchetansingh@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
Diffstat (limited to 'seccomp')
| -rw-r--r-- | seccomp/x86_64/gpu_device.policy | 2 |
1 files changed, 1 insertions, 1 deletions
diff --git a/seccomp/x86_64/gpu_device.policy b/seccomp/x86_64/gpu_device.policy index 233f00f..b6caa82 100644 --- a/seccomp/x86_64/gpu_device.policy +++ b/seccomp/x86_64/gpu_device.policy @@ -56,7 +56,7 @@ lstat: 1 # Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING memfd_create: arg1 == 3 # mmap/mprotect/open/openat differ from the common_device.policy -mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC +mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ open: 1 openat: 1 |