1# Copyright 2021 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Copyright 2021 The ChromiumOS Authors
6# Use of this source code is governed by a BSD-style license that can be
7# found in the LICENSE file.
8
9# Rules from common_device.policy with some rules removed because they block certain flags needed
10# for gpu.
11brk: 1
12clock_gettime: 1
13clone3: 1
14close: 1
15dup2: 1
16dup: 1
17epoll_create1: 1
18epoll_ctl: 1
19epoll_pwait: 1
20epoll_wait: 1
21eventfd2: 1
22exit: 1
23exit_group: 1
24ftruncate: 1
25futex: 1
26getcwd: 1
27getpid: 1
28gettid: 1
29gettimeofday: 1
30io_uring_setup: 1
31io_uring_register: 1
32io_uring_enter: 1
33kill: 1
34madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
35membarrier: 1
36# memfd_create is used for sharing memory with wayland.
37# For normal use case, we allow arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING, with or without MFD_NOEXEC_SEAL.
38# or simply MFD_CLOEXEC.
39# However, we allow all the arguments here for backtrace when it panics.
40memfd_create: 1
41mremap: 1
42munmap: 1
43nanosleep: 1
44clock_nanosleep: 1
45pipe2: 1
46poll: 1
47ppoll: 1
48read: 1
49readlink: 1
50readlinkat: 1
51readv: 1
52recvfrom: 1
53recvmsg: 1
54restart_syscall: 1
55rseq: 1
56rt_sigaction: 1
57rt_sigprocmask: 1
58rt_sigreturn: 1
59sched_getaffinity: 1
60sched_yield: 1
61sendmsg: 1
62sendto: 1
63set_robust_list: 1
64sigaltstack: 1
65tgkill: arg2 == SIGABRT
66write: 1
67writev: 1
68uname: 1
69
70# Rules specific to gpu
71connect: 1
72# 1033 is F_ADD_SEALS, 1034 is F_GET_SEALS
73fcntl: arg1 == F_DUPFD_CLOEXEC || arg1 == F_GETFD || arg1 == F_SETFD || \
74       arg1 == F_GETFL || arg1 == F_SETFL || arg1 == 1033 || arg1 == 1034
75fstat: 1
76getdents: 1
77getdents64: 1
78geteuid: 1
79getrandom: 1
80getuid: 1
81# 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x6400 == DRM_IOCTL_BASE, 0x40087543 == UDMABUF_CREATE_LIST
82ioctl: arg1 == FIONBIO || arg1 == FIOCLEX || arg1 == 0x40086200 || arg1 & 0x6400 || arg1 == 0x40087543 || arg1 == 0x5421 || arg1 == 0xc0383e04 || arg1 == 0xc018aa3f || arg1 == 0xaa00
83lseek: 1
84lstat: 1
85# mmap/mprotect/open/openat differ from the common_device.policy
86mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
87mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
88open: 1
89openat: 1
90stat: 1
91statx: 1
92sysinfo: 1
93fstatfs: 1
94prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
95
96# Required for perfetto tracing
97# fcntl: arg1 == F_SETFD || arg1 == F_GETFL || arg1 == F_SETFL (merged above)
98getsockopt: 1
99shutdown: 1
100
101# Rules for Mesa's shader binary cache.
102fallocate: 1
103flock: 1
104inotify_add_watch: 1
105inotify_init1: 1
106inotify_rm_watch: 1
107mkdir: 1
108newfstatat: 1
109rename: 1
110setpriority: 1
111unlink: 1
112
113# Rules specific to AMD gpus.
114sched_setscheduler: 1
115sched_setaffinity: 1
116kcmp: 1
117
118# Rules for Vulkan loader / layers
119access: 1
120getgid: 1
121getegid: 1
122
123## Rules for vmm-swap
124userfaultfd: 1
125# 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
126# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
127
128# allow fork() and waitid()
129clone: 1
130waitid: 1
131
132# allow SOCK_STREAM and SOCK_DGRAM (syslog)
133socket: arg0 == AF_UNIX && arg2 == 0
134
135# allow socketpair(AF_UNIX, SOCK_SEQPACKET | SOCK_CLOEXEC)
136socketpair: arg0 == AF_UNIX && arg1 == SOCK_SEQPACKET|SOCK_CLOEXEC && arg2 == 0
137
138# allow signalfd()
139signalfd4: 1
140