summary refs log tree commit diff
path: root/seccomp/x86_64/net_device.policy
Commit message (Collapse)AuthorAge
* devices: use PollContext for all virtio deivcesZach Reizner2018-04-05
| | | | | | | | | | | BUG=chromium:816692 TEST=run any VM Change-Id: I4219050fdb7947ca513f599f1ac57cde6052d397 Reviewed-on: https://chromium-review.googlesource.com/996917 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* sys_util: use MADV_DONTDUMP for new mmapsZach Reizner2018-03-30
| | | | | | | | | | | | | | | | The mmaps made through the sys_util API are usually for guest memory or other large shared memory chunks that will pollute the file system with huge dumps on crash. By using MADV_DONTDUMP, we save the file system from storing these useless data segments when crosvm crashes. TEST=./build_test BUG=None Change-Id: I2041523648cd7c150bbdbfceef589f42d3f9c2b9 Reviewed-on: https://chromium-review.googlesource.com/890279 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* sys_util: add ppoll to seccomp policiesZach Reizner2018-01-27
| | | | | | | | | | | | | | This really should have been added along with the poll timeout support, which changed the syscalls used in every jailed device. TEST=run crosvm with sandboxing enabled BUG=None Change-Id: I6129fa589640bb2b85fb4274775192bdd49db672 Reviewed-on: https://chromium-review.googlesource.com/890379 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* crosvm: don't die on suspend/resumeStephen Barber2017-11-02
| | | | | | | | | | | | | | | Suspend/resume can cause syscall restarts and will cause KVM_RUN ioctls to return with EINTR. Handle these so the VM doesn't shut down. BUG=none TEST=vm survives suspend/resume Change-Id: I1fab624cb8fe0949d341408f0c962c859a034205 Reviewed-on: https://chromium-review.googlesource.com/750054 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
* crosvm/devices: set thread namesStephen Barber2017-10-30
| | | | | | | | | | | | | | | | crosvm spawns a lot of processes/threads, and having these all use the same name as the original process can be confusing. So at least in the instances where Rust threads are spawned (vs. minijail_fork()), use a thread::Builder to allow setting the thread name. BUG=none TEST=start crosvm, check thread names with top Change-Id: I6e55ff5fd60f258880bda8e656ab7f9da82c656e Reviewed-on: https://chromium-review.googlesource.com/742394 Commit-Ready: Stephen Barber <smbarber@chromium.org> Tested-by: Stephen Barber <smbarber@chromium.org> Reviewed-by: Stephen Barber <smbarber@chromium.org>
* Add ability to minijail_forkDylan Reid2017-10-25
| | | | | | | | Change-Id: I0c774816067449cbb838dcf29c6fa947ae5916e1 Reviewed-on: https://chromium-review.googlesource.com/719442 Commit-Ready: Dylan Reid <dgreid@chromium.org> Tested-by: Dylan Reid <dgreid@chromium.org> Reviewed-by: Zach Reizner <zachr@chromium.org>
* sys_util: use libc's openlog to connect to syslogZach Reizner2017-09-06
| | | | | | | | | | | | | | | | | | | | | | | By using libc's openlog, we can ensure that the internal state of the libc syslogger is consistent with the syslog module. Minijail will be able to print to stderr and the syslog in the same way the logging macros in crosvm do. The FD the syslog module uses is shared with libc and via `syslog::get_fds`, jailed processes can inherit the needed FDs to continue logging. Now that `sys_log::init()` must be called in single threaded process, this moves its tests to the list of the serially run ones in build_test.py. TEST=./build_test BUG=None Change-Id: I8dbc8ebf9d97ef670185259eceac5f6d3d6824ea Reviewed-on: https://chromium-review.googlesource.com/649951 Commit-Ready: Zach Reizner <zachr@chromium.org> Tested-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Jason Clinton <jclinton@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>
* Put seccomp policy files in a common directoryChirantan Ekbote2017-08-25
We will almost certainly require different seccomp policy files for different architectures. Move all the existing secommp policy files into a common directory grouped by architecture. This will make it easier to install them via the ebuild later. BUG=none TEST=none Change-Id: I0495789cd4143dc374ee6ebe083dc20ce724edbb Signed-off-by: Chirantan Ekbote <chirantan@chromium.org> Reviewed-on: https://chromium-review.googlesource.com/630058 Reviewed-by: Zach Reizner <zachr@chromium.org> Reviewed-by: Dylan Reid <dgreid@chromium.org>