diff options
| author | Chirantan Ekbote <chirantan@chromium.org> | 2019-11-14 18:45:56 +0900 |
|---|---|---|
| committer | Commit Bot <commit-bot@chromium.org> | 2019-11-19 17:59:49 +0000 |
| commit | b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a (patch) | |
| tree | 0c91cb528e737b8581e78ac13cf05de5f5601aad /seccomp | |
| parent | bd4723b218fab426f575e70df5c0e437bd40669f (diff) | |
| download | crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.tar crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.tar.gz crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.tar.bz2 crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.tar.lz crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.tar.xz crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.tar.zst crosvm-b0ac00745a2780b841d5c6590d8dbb0e8b65ba0a.zip | |
Enable seccomp for virtio-fs
Add x86_64 and arm seccomp policy files for the virtio-fs device. BUG=b:136128319 TEST=Run a vm with a sandboxed virtio-fs device Change-Id: I8ea7c5d3e90696077f0c2b1f942cb286a0b36cf4 Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1916559 Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org> Tested-by: kokoro <noreply+kokoro@google.com> Commit-Queue: Chirantan Ekbote <chirantan@chromium.org>
Diffstat (limited to 'seccomp')
| -rw-r--r-- | seccomp/arm/fs_device.policy | 32 | ||||
| -rw-r--r-- | seccomp/x86_64/fs_device.policy | 32 |
2 files changed, 64 insertions, 0 deletions
diff --git a/seccomp/arm/fs_device.policy b/seccomp/arm/fs_device.policy new file mode 100644 index 0000000..2d90307 --- /dev/null +++ b/seccomp/arm/fs_device.policy @@ -0,0 +1,32 @@ +# Copyright 2019 The Chromium OS Authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +openat: 1 + +@include /usr/share/policy/crosvm/common_device.policy + +fchmodat: 1 +fchownat: 1 +fgetxattr: 1 +fsetxattr: 1 +fstatat64: 1 +fstatfs64: 1 +ftruncate64: 1 +getdents64: 1 +getegid: 1 +geteuid: 1 +linkat: 1 +_llseek: 1 +mkdirat: 1 +mknodat: 1 +preadv: 1 +pwritev: 1 +readlinkat: 1 +renameat2: 1 +setresgid: 1 +setresuid: 1 +symlinkat: 1 +umask: 1 +unlinkat: 1 +utimensat: 1 \ No newline at end of file diff --git a/seccomp/x86_64/fs_device.policy b/seccomp/x86_64/fs_device.policy new file mode 100644 index 0000000..cbf0288 --- /dev/null +++ b/seccomp/x86_64/fs_device.policy @@ -0,0 +1,32 @@ +# Copyright 2019 The Chromium OS Authors. All rights reserved. +# Use of this source code is governed by a BSD-style license that can be +# found in the LICENSE file. + +openat: 1 + +@include /usr/share/policy/crosvm/common_device.policy + +fchmodat: 1 +fchownat: 1 +fgetxattr: 1 +fsetxattr: 1 +fstatfs: 1 +ftruncate: 1 +getdents64: 1 +getegid: 1 +geteuid: 1 +linkat: 1 +lseek: 1 +mkdirat: 1 +mknodat: 1 +newfstatat: 1 +preadv: 1 +pwritev: 1 +readlinkat: 1 +renameat2: 1 +setresgid: 1 +setresuid: 1 +symlinkat: 1 +umask: 1 +unlinkat: 1 +utimensat: 1 \ No newline at end of file |