xref: /aosp_15_r20/external/crosvm/jail/seccomp/aarch64/gpu_common.policy (revision bb4ee6a4ae7042d18b07a98463b9c8b875e44b39)
1# Copyright 2021 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Rules from common_device.policy with some rules removed because they block certain flags needed
6# for gpu.
7brk: 1
8clock_gettime: 1
9clone3: 1
10close: 1
11dup3: 1
12dup: 1
13epoll_create1: 1
14epoll_ctl: 1
15epoll_pwait: 1
16eventfd2: 1
17exit: 1
18exit_group: 1
19ftruncate: 1
20futex: 1
21getcwd: 1
22getpid: 1
23gettid: 1
24gettimeofday: 1
25io_uring_setup: 1
26io_uring_register: 1
27io_uring_enter: 1
28kill: 1
29madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
30membarrier: 1
31# memfd_create is used for sharing memory with wayland.
32# For normal use case, we allow arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL.
33# However, we allow all the arguments here for backtrace when it panics.
34memfd_create: 1
35mremap: 1
36munmap: 1
37nanosleep: 1
38clock_nanosleep: 1
39pipe2: 1
40ppoll: 1
41read: 1
42readlinkat: 1
43readv: 1
44recvfrom: 1
45recvmsg: 1
46restart_syscall: 1
47rseq: 1
48rt_sigaction: 1
49rt_sigprocmask: 1
50rt_sigreturn: 1
51sched_getaffinity: 1
52sched_yield: 1
53sendmsg: 1
54sendto: 1
55set_robust_list: 1
56sigaltstack: 1
57write: 1
58writev: 1
59uname: 1
60
61# Required for perfetto tracing
62getsockopt: 1
63shutdown: 1
64
65## Rules specific to gpu
66connect: 1
67getrandom: 1
68lseek: 1
69statx: 1
70fstat: 1
71newfstatat: 1
72getdents64: 1
73sysinfo: 1
74fstatfs: 1
75prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
76
77# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
78# (from vmm-swap below) 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
79# (from wl_device) arg1 == FIONBIO || arg1 == DMA_BUF_IOCTL_SYNC || arg1 == SYNC_IOC_FILE_INFO || arg1 & DRM_IOCTL_BASE
80ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543 || arg1 == 0xc018aa3f || arg1 == 0xaa00 || arg1 == 0x5421 || arg1 == 0x40086200 || arg1 == 0xc0383e04 || arg1 & 0x6400
81
82## mmap/mprotect differ from the common_device.policy
83mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
84mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
85openat: 1
86
87## Rules specific to pvr
88geteuid: 1
89getuid: 1
90fcntl: 1
91tgkill: 1
92
93# Rules specific to Mesa.
94sched_setscheduler: 1
95sched_setaffinity: 1
96kcmp: 1
97
98# Rules for Mesa's u_trace thread
99setpriority: 1
100
101# Rules for Vulkan loader / layers
102faccessat: 1
103faccessat2: 1
104getgid: 1
105getegid: 1
106
107## Rules for vmm-swap
108userfaultfd: 1
109# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
110# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
111
112## Rules for mali shader dump (debug workflow)
113mkdirat: 1
114