xref: /aosp_15_r20/external/crosvm/jail/seccomp/x86_64/gpu_common.policy (revision bb4ee6a4ae7042d18b07a98463b9c8b875e44b39)
1# Copyright 2021 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Rules from common_device.policy with some rules removed because they block certain flags needed
6# for gpu.
7brk: 1
8clock_gettime: 1
9clone3: 1
10close: 1
11dup2: 1
12dup: 1
13epoll_create1: 1
14epoll_ctl: 1
15epoll_pwait: 1
16epoll_wait: 1
17eventfd2: 1
18exit: 1
19exit_group: 1
20ftruncate: 1
21futex: 1
22getcwd: 1
23getpid: 1
24gettid: 1
25gettimeofday: 1
26io_uring_setup: 1
27io_uring_register: 1
28io_uring_enter: 1
29kill: 1
30madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
31membarrier: 1
32# memfd_create is used for sharing memory with wayland.
33# For normal use case, we allow arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL.
34# or simply MFD_CLOEXEC.
35# However, we allow all the arguments here for backtrace when it panics.
36memfd_create: 1
37mremap: 1
38munmap: 1
39nanosleep: 1
40clock_nanosleep: 1
41pipe2: 1
42poll: 1
43ppoll: 1
44read: 1
45readlink: 1
46readlinkat: 1
47readv: 1
48recvfrom: 1
49recvmsg: 1
50restart_syscall: 1
51rseq: 1
52rt_sigaction: 1
53rt_sigprocmask: 1
54rt_sigreturn: 1
55sched_getaffinity: 1
56sched_yield: 1
57sendmsg: 1
58sendto: 1
59set_robust_list: 1
60sigaltstack: 1
61tgkill: arg2 == SIGABRT
62write: 1
63writev: 1
64uname: 1
65
66# Rules specific to gpu
67connect: 1
68# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS
69fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_GETFD || arg1 == F_SETFD || \
70       arg1 == F_GETFL || arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034
71fstat: 1
72getdents: 1
73getdents64: 1
74geteuid: 1
75getrandom: 1
76getuid: 1
77# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST
78ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543 || arg1 == 0x5421 || arg1 == 0xc0383e04 || arg1 == 0xc018aa3f || arg1 == 0xaa00
79lseek: 1
80lstat: 1
81# mmap/mprotect/open/openat differ from the common_device.policy
82mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
83mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
84open: 1
85openat: 1
86stat: 1
87statx: 1
88sysinfo: 1
89fstatfs: 1
90prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
91
92# Required for perfetto tracing
93# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
94getsockopt: 1
95shutdown: 1
96
97# Rules for Mesa's shader binary cache.
98fallocate: 1
99flock: 1
100inotify_add_watch: 1
101inotify_init1: 1
102inotify_rm_watch: 1
103mkdir: 1
104newfstatat: 1
105rename: 1
106setpriority: 1
107unlink: 1
108
109# Rules specific to AMD gpus.
110sched_setscheduler: 1
111sched_setaffinity: 1
112kcmp: 1
113
114# Rules for Vulkan loader / layers
115access: 1
116getgid: 1
117getegid: 1
118
119## Rules for vmm-swap
120userfaultfd: 1
121# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
122# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
123