1# Copyright 2021 The ChromiumOS Authors 2# Use of this source code is governed by a BSD-style license that can be 3# found in the LICENSE file. 4 5# Copyright 2021 The ChromiumOS Authors 6# Use of this source code is governed by a BSD-style license that can be 7# found in the LICENSE file. 8 9# Rules from common_device.policy with some rules removed because they block certain flags needed 10# for gpu. 11brk: 1 12clock_gettime: 1 13clone3: 1 14close: 1 15dup2: 1 16dup: 1 17epoll_create1: 1 18epoll_ctl: 1 19epoll_pwait: 1 20epoll_wait: 1 21eventfd2: 1 22exit: 1 23exit_group: 1 24ftruncate: 1 25futex: 1 26getcwd: 1 27getpid: 1 28gettid: 1 29gettimeofday: 1 30io_uring_setup: 1 31io_uring_register: 1 32io_uring_enter: 1 33kill: 1 34madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE 35membarrier: 1 36# memfd_create is used for sharing memory with wayland. 37# For normal use case, we allow arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL. 38# or simply MFD_CLOEXEC. 39# However, we allow all the arguments here for backtrace when it panics. 40memfd_create: 1 41mremap: 1 42munmap: 1 43nanosleep: 1 44clock_nanosleep: 1 45pipe2: 1 46poll: 1 47ppoll: 1 48read: 1 49readlink: 1 50readlinkat: 1 51readv: 1 52recvfrom: 1 53recvmsg: 1 54restart_syscall: 1 55rseq: 1 56rt_sigaction: 1 57rt_sigprocmask: 1 58rt_sigreturn: 1 59sched_getaffinity: 1 60sched_yield: 1 61sendmsg: 1 62sendto: 1 63set_robust_list: 1 64sigaltstack: 1 65tgkill: arg2 == SIGABRT 66write: 1 67writev: 1 68uname: 1 69unlinkat: 1 70 71# Rules specific to gpu 72connect: 1 73# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS 74fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_GETFD || arg1 == F_SETFD || \ 75 arg1 == F_GETFL || arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034 76fstat: 1 77getdents: 1 78getdents64: 1 79geteuid: 1 80getrandom: 1 81getuid: 1 82# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST 83ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543 || arg1 == 0x5421 || arg1 == 0xc0383e04 || arg1 == 0xc018aa3f || arg1 == 0xaa00 84lseek: 1 85lstat: 1 86# mmap/mprotect/open/openat differ from the common_device.policy 87mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ 88mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ 89open: 1 90openat: 1 91stat: 1 92statx: 1 93sysinfo: 1 94fstatfs: 1 95prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME 96 97# Required for perfetto tracing 98# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above) 99getsockopt: 1 100shutdown: 1 101 102# Rules for Mesa's shader binary cache. 103fallocate: 1 104flock: 1 105inotify_add_watch: 1 106inotify_init1: 1 107inotify_rm_watch: 1 108mkdir: 1 109newfstatat: 1 110rename: 1 111setpriority: 1 112unlink: 1 113 114# Rules specific to AMD gpus. 115sched_setscheduler: 1 116sched_setaffinity: 1 117kcmp: 1 118 119# Rules for Vulkan loader / layers 120access: 1 121getgid: 1 122getegid: 1 123 124## Rules for vmm-swap 125userfaultfd: 1 126# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW 127# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00 128 129# allow fork() and waitid() 130clone: 1 131waitid: 1 132 133# allow SOCK_STREAM and SOCK_DGRAM (syslog) 134socket: arg0 == AF_UNIX && arg2 == 0 135 136# allow socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC) 137socketpair: arg0 == AF_UNIX && arg1 == SOCK_SEQPACKET|SOCK_CLOEXEC && arg2 == 0 138 139# allow signalfd() 140signalfd4: 1 141