seccomp: Add initial arm64 seccomp filters

BUG=chromium:1029666
TEST=tast run crostini.LaunchTerminal.download_buster

Change-Id: I8fa7dc9df4d5f0144aed80fcd60307036fc7e16d
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform/crosvm/+/1946765
Reviewed-by: Stephen Barber <smbarber@chromium.org>
Tested-by: kokoro <noreply+kokoro@google.com>
Tested-by: Stephen Barber <smbarber@chromium.org>
Commit-Queue: Stephen Barber <smbarber@chromium.org>

18 files changed, 423 insertions, 0 deletions

diff --git a/seccomp/aarch64/9p_device.policy b/seccomp/aarch64/9p_device.policy
new file mode 100644
index 0000000..f52e971
--- /dev/null
+++ b/seccomp/aarch64/9p_device.policy
@@ -0,0 +1,26 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+pread64: 1
+pwrite64: 1
+statx: 1
+openat: 1
+fstat: 1
+ioctl: arg1 == FIOCLEX
+getdents64: 1
+fdatasync: 1
+fsync: 1
+mkdirat: 1
+renameat: 1
+writev: 1
+linkat: 1
+unlinkat: 1
+socket: arg0 == AF_UNIX
+utimensat: 1
+ftruncate: 1
+fchown: arg1 == 0xffffffff && arg2 == 0xffffffff
+statfs: 1
+newfstatat: 1
diff --git a/seccomp/aarch64/balloon_device.policy b/seccomp/aarch64/balloon_device.policy
new file mode 100644
index 0000000..f9e98f0
--- /dev/null
+++ b/seccomp/aarch64/balloon_device.policy
@@ -0,0 +1,5 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
diff --git a/seccomp/aarch64/block_device.policy b/seccomp/aarch64/block_device.policy
new file mode 100644
index 0000000..14287e3
--- /dev/null
+++ b/seccomp/aarch64/block_device.policy
@@ -0,0 +1,17 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+fallocate: 1
+fdatasync: 1
+fstat: 1
+fsync: 1
+ftruncate: 1
+lseek: 1
+preadv: 1
+pwritev: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
diff --git a/seccomp/aarch64/common_device.policy b/seccomp/aarch64/common_device.policy
new file mode 100644
index 0000000..b5dcf9f
--- /dev/null
+++ b/seccomp/aarch64/common_device.policy
@@ -0,0 +1,44 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getpid: 1
+gettimeofday: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+openat: return ENOENT
+pipe2: 1
+ppoll: 1
+prctl: arg0 == PR_SET_NAME
+read: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
diff --git a/seccomp/aarch64/cras_audio_device.policy b/seccomp/aarch64/cras_audio_device.policy
new file mode 100644
index 0000000..ef9b5ed
--- /dev/null
+++ b/seccomp/aarch64/cras_audio_device.policy
@@ -0,0 +1,14 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+madvise: 1
+prlimit64: 1
+setrlimit: 1
+recvmsg: 1
+sched_setscheduler: 1
+sendmsg: 1
+socketpair: arg0 == AF_UNIX
+clock_gettime: 1
diff --git a/seccomp/aarch64/fs_device.policy b/seccomp/aarch64/fs_device.policy
new file mode 100644
index 0000000..7e0c015
--- /dev/null
+++ b/seccomp/aarch64/fs_device.policy
@@ -0,0 +1,32 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+openat: 1
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+fchmodat: 1
+fchownat: 1
+fgetxattr: 1
+fsetxattr: 1
+newfstatat: 1
+fstatfs: 1
+ftruncate: 1
+getdents64: 1
+getegid: 1
+geteuid: 1
+linkat: 1
+lseek: 1
+mkdirat: 1
+mknodat: 1
+preadv: 1
+pwritev: 1
+readlinkat: 1
+renameat2: 1
+setresgid: 1
+setresuid: 1
+symlinkat: 1
+umask: 1
+unlinkat: 1
+utimensat: 1
diff --git a/seccomp/aarch64/gpu_device.policy b/seccomp/aarch64/gpu_device.policy
new file mode 100644
index 0000000..1daedc2
--- /dev/null
+++ b/seccomp/aarch64/gpu_device.policy
@@ -0,0 +1,72 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# Rules from common_device.policy with some rules removed because they block certain flags needed
+# for gpu.
+brk: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getpid: 1
+gettimeofday: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mremap: 1
+munmap: 1
+nanosleep: 1
+open: return ENOENT
+pipe2: 1
+ppoll: 1
+prctl: arg0 == PR_SET_NAME
+read: 1
+readv: 1
+recv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+writev: 1
+
+## Rules specific to gpu
+connect: 1
+getrandom: 1
+socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
+lseek: 1
+ftruncate: 1
+statx: 1
+fstat: 1
+getdents64: 1
+
+# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali)
+ioctl: arg1 & 0x6400 || arg1 & 0x8000
+
+## mmap/mprotect/openat differ from the common_device.policy
+mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
+mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
+openat: 1
+
+## Rules specific to pvr
+geteuid: 1
+getuid: 1
+readlinkat: 1
+gettid: 1
+fcntl: 1
+tgkill: 1
+clock_gettime: 1
diff --git a/seccomp/aarch64/input_device.policy b/seccomp/aarch64/input_device.policy
new file mode 100644
index 0000000..f26998e
--- /dev/null
+++ b/seccomp/aarch64/input_device.policy
@@ -0,0 +1,9 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+ioctl: 1
+fcntl: 1
+getsockname: 1
diff --git a/seccomp/aarch64/net_device.policy b/seccomp/aarch64/net_device.policy
new file mode 100644
index 0000000..f9e98f0
--- /dev/null
+++ b/seccomp/aarch64/net_device.policy
@@ -0,0 +1,5 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
diff --git a/seccomp/aarch64/null_audio_device.policy b/seccomp/aarch64/null_audio_device.policy
new file mode 100644
index 0000000..46864c1
--- /dev/null
+++ b/seccomp/aarch64/null_audio_device.policy
@@ -0,0 +1,10 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+madvise: 1
+prlimit64: 1
+setrlimit: 1
+clock_gettime: 1
diff --git a/seccomp/aarch64/pmem_device.policy b/seccomp/aarch64/pmem_device.policy
new file mode 100644
index 0000000..b3cd64d
--- /dev/null
+++ b/seccomp/aarch64/pmem_device.policy
@@ -0,0 +1,8 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+fdatasync: 1
+fsync: 1
diff --git a/seccomp/aarch64/rng_device.policy b/seccomp/aarch64/rng_device.policy
new file mode 100644
index 0000000..f9e98f0
--- /dev/null
+++ b/seccomp/aarch64/rng_device.policy
@@ -0,0 +1,5 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
diff --git a/seccomp/aarch64/serial.policy b/seccomp/aarch64/serial.policy
new file mode 100644
index 0000000..f9e98f0
--- /dev/null
+++ b/seccomp/aarch64/serial.policy
@@ -0,0 +1,5 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
diff --git a/seccomp/aarch64/tpm_device.policy b/seccomp/aarch64/tpm_device.policy
new file mode 100644
index 0000000..66e0ef1
--- /dev/null
+++ b/seccomp/aarch64/tpm_device.policy
@@ -0,0 +1,58 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+# common policy
+brk: 1
+clone: arg0 & CLONE_THREAD
+close: 1
+dup2: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_wait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+futex: 1
+getpid: 1
+gettimeofday: 1
+kill: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
+mmap2: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+#open: return ENOENT
+#openat: return ENOENT
+pipe2: 1
+poll: 1
+ppoll: 1
+prctl: arg0 == PR_SET_NAME
+read: 1
+recv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sendmsg: 1
+set_robust_list: 1
+sigaltstack: 1
+write: 1
+
+# tpm-specific policy
+chdir: 1
+fstat: 1
+fsync: 1
+ftruncate: 1
+getuid: 1
+lseek: 1
+mkdir: 1
+open: 1
+openat: 1
+socket: return EACCES
+stat: 1
diff --git a/seccomp/aarch64/vhost_net_device.policy b/seccomp/aarch64/vhost_net_device.policy
new file mode 100644
index 0000000..1868322
--- /dev/null
+++ b/seccomp/aarch64/vhost_net_device.policy
@@ -0,0 +1,23 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+# Whitelist vhost_net ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+# arg1 == VHOST_NET_SET_BACKEND
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22 || arg1 == 0x4008af30
diff --git a/seccomp/aarch64/vhost_vsock_device.policy b/seccomp/aarch64/vhost_vsock_device.policy
new file mode 100644
index 0000000..9cdc57f
--- /dev/null
+++ b/seccomp/aarch64/vhost_vsock_device.policy
@@ -0,0 +1,24 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+# Whitelist vhost_vsock ioctls only.
+# arg1 == VHOST_GET_FEATURES ||
+# arg1 == VHOST_SET_FEATURES ||
+# arg1 == VHOST_SET_OWNER ||
+# arg1 == VHOST_RESET_OWNER ||
+# arg1 == VHOST_SET_MEM_TABLE ||
+# arg1 == VHOST_SET_LOG_BASE ||
+# arg1 == VHOST_SET_LOG_FD ||
+# arg1 == VHOST_SET_VRING_NUM ||
+# arg1 == VHOST_SET_VRING_ADDR ||
+# arg1 == VHOST_SET_VRING_BASE ||
+# arg1 == VHOST_GET_VRING_BASE ||
+# arg1 == VHOST_SET_VRING_KICK ||
+# arg1 == VHOST_SET_VRING_CALL ||
+# arg1 == VHOST_SET_VRING_ERR ||
+# arg1 == VHOST_VSOCK_SET_GUEST_CID ||
+# arg1 == VHOST_VSOCK_SET_RUNNING
+ioctl: arg1 == 0x8008af00 || arg1 == 0x4008af00 || arg1 == 0x0000af01 || arg1 == 0x0000af02 || arg1 == 0x4008af03 || arg1 == 0x4008af04 || arg1 == 0x4004af07 || arg1 == 0x4008af10 || arg1 == 0x4028af11 || arg1 == 0x4008af12 || arg1 == 0xc008af12 || arg1 == 0x4008af20 || arg1 == 0x4008af21 || arg1 == 0x4008af22 || arg1 == 0x4008af60 || arg1 == 0x4004af61
diff --git a/seccomp/aarch64/wl_device.policy b/seccomp/aarch64/wl_device.policy
new file mode 100644
index 0000000..d8bbccd
--- /dev/null
+++ b/seccomp/aarch64/wl_device.policy
@@ -0,0 +1,22 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+# Used to connect to wayland. arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC
+socket: arg0 == 1 && arg1 == 0x80001 && arg2 == 0
+# arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC
+ioctl: arg1 == 0x5421 || arg1 == 0x40086200
+connect: 1
+# Used to communicate with wayland
+recvmsg: 1
+sendmsg: 1
+# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
+memfd_create: arg1 == 3
+# Used to set of size new memfd
+ftruncate: 1
+# Used to determine shm size after recvmsg with fd
+lseek: 1
+# Allow F_GETFL only
+fcntl: arg1 == 3
diff --git a/seccomp/aarch64/xhci.policy b/seccomp/aarch64/xhci.policy
new file mode 100644
index 0000000..7e5b1c7
--- /dev/null
+++ b/seccomp/aarch64/xhci.policy
@@ -0,0 +1,44 @@
+# Copyright 2019 The Chromium OS Authors. All rights reserved.
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+openat: 1
+@include /usr/share/policy/crosvm/common_device.policy
+
+statx: 1
+fcntl: 1
+readlinkat: 1
+getdents64: 1
+getrandom: 1
+name_to_handle_at: 1
+faccessat: 1
+gettid: 1
+clock_gettime: 1
+timerfd_create: 1
+getsockname: 1
+pipe2: 1
+setsockopt: 1
+bind: 1
+fcntl: 1
+socket: arg0 == AF_NETLINK
+uname: 1
+# The following ioctls are:
+# 0x4004550d == USBDEVFS_REAPURBNDELAY32
+# 0x550b     == USBDEVFS_DISCARDURB
+# 0x8004550f == USBDEVFS_CLAIMINTERFACE
+# 0x80045510 == USBDEVFS_RELEASEINTERFACE
+# 0x8004551a == USBDEVFS_GET_CAPABILITIES
+# 0x802c550a == USBDEVFS_SUBMITURB
+# 0xc0105500 == USBDEVFS_CONTROL
+# 0x5514 == USBDEVFS_RESET
+# 0x80045505 == USBDEVFS_SETCONFIGURATION
+# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
+# 0x40085511 == USBDEVFS_CONNECTINFO
+# 0x80185520 == USBDEVFS_CONNINFO_EX
+ioctl: arg1 == 0xc0105500 || arg1 == 0x802c550a || arg1 == 0x8004551a || arg1 == 0x4004550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520
+fstat: 1
+sigaltstack: 1
+recvmsg: 1
+getrandom: 1
+getdents64: 1
+lseek: 1