|
@@ -1,4 +1,4 @@
|
|
|
-From 84da4a17ea04e573dbed6d5fc4dcb71bd71c2b63 Mon Sep 17 00:00:00 2001
|
|
|
+From 917c9477fcc0d7f11fca87ecabce44c74be0a81b Mon Sep 17 00:00:00 2001
|
|
|
From: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
Date: Wed, 15 Jun 2022 08:27:45 +0000
|
|
|
Subject: [PATCH] sandbox: add riscv arch definition and define syscall
|
|
@@ -14,7 +14,7 @@ Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
sandbox/linux/bpf_dsl/seccomp_macros.h | 41 +
|
|
|
.../seccomp-bpf-helpers/baseline_policy.cc | 9 +-
|
|
|
.../syscall_parameters_restrictions.cc | 3 +-
|
|
|
- .../linux/seccomp-bpf-helpers/syscall_sets.cc | 73 +-
|
|
|
+ .../linux/seccomp-bpf-helpers/syscall_sets.cc | 71 +-
|
|
|
.../linux/seccomp-bpf-helpers/syscall_sets.h | 11 +-
|
|
|
sandbox/linux/seccomp-bpf/syscall.cc | 35 +-
|
|
|
sandbox/linux/services/credentials.cc | 2 +-
|
|
@@ -24,10 +24,10 @@ Signed-off-by: Rebecca Chang Swee Fun <rebecca.chang@starfivetech.com>
|
|
|
sandbox/linux/system_headers/linux_signal.h | 2 +-
|
|
|
sandbox/linux/system_headers/linux_stat.h | 2 +-
|
|
|
sandbox/linux/system_headers/linux_syscalls.h | 4 +
|
|
|
- .../system_headers/riscv64_linux_syscalls.h | 1070 +++++++++++++++++
|
|
|
+ .../system_headers/riscv64_linux_syscalls.h | 1074 +++++++++++++++++
|
|
|
.../linux/bpf_cros_amd_gpu_policy_linux.cc | 2 +-
|
|
|
sandbox/policy/linux/bpf_gpu_policy_linux.cc | 2 +-
|
|
|
- 19 files changed, 1247 insertions(+), 53 deletions(-)
|
|
|
+ 19 files changed, 1249 insertions(+), 53 deletions(-)
|
|
|
create mode 100644 sandbox/linux/system_headers/riscv64_linux_syscalls.h
|
|
|
|
|
|
diff --git a/sandbox/features.gni b/sandbox/features.gni
|
|
@@ -197,7 +197,7 @@ index 9728d0b52e68..6f6e3984028b 100644
|
|
|
PTRACE_GETREGSET,
|
|
|
#endif
|
|
|
diff --git a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
|
|
|
-index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
+index b3cf6fc7e86f..39dceabf07c3 100644
|
|
|
--- a/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
|
|
|
+++ b/sandbox/linux/seccomp-bpf-helpers/syscall_sets.cc
|
|
|
@@ -103,7 +103,7 @@ bool SyscallSets::IsUmask(int sysno) {
|
|
@@ -232,7 +232,7 @@ index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
case __NR_fchown32:
|
|
|
#endif
|
|
|
-#if !defined(__aarch64__)
|
|
|
-+#if !defined(__aarch64__) || defined(__riscv)
|
|
|
++#if !defined(__aarch64__) && !defined(__riscv)
|
|
|
case __NR_getdents: // EPERM not a valid errno.
|
|
|
#endif
|
|
|
case __NR_getdents64: // EPERM not a valid errno.
|
|
@@ -403,27 +403,25 @@ index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
case __NR_eventfd:
|
|
|
#endif
|
|
|
case __NR_eventfd2:
|
|
|
-@@ -896,7 +896,8 @@ bool SyscallSets::IsKeyManagement(int sysno) {
|
|
|
+@@ -896,7 +896,7 @@ bool SyscallSets::IsKeyManagement(int sysno) {
|
|
|
}
|
|
|
|
|
|
#if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
|
|
|
- (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS))
|
|
|
-+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) || \
|
|
|
-+ defined(__riscv)
|
|
|
++ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) || defined(__riscv)
|
|
|
bool SyscallSets::IsSystemVSemaphores(int sysno) {
|
|
|
switch (sysno) {
|
|
|
case __NR_semctl:
|
|
|
-@@ -916,7 +917,8 @@ bool SyscallSets::IsSystemVSemaphores(int sysno) {
|
|
|
+@@ -915,7 +915,7 @@ bool SyscallSets::IsSystemVSemaphores(int sysno) {
|
|
|
+ #endif
|
|
|
|
|
|
#if defined(__i386__) || defined(__x86_64__) || defined(__arm__) || \
|
|
|
- defined(__aarch64__) || \
|
|
|
-- (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS))
|
|
|
-+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS)) || \
|
|
|
-+ defined(__riscv)
|
|
|
+- defined(__aarch64__) || \
|
|
|
++ defined(__aarch64__) || defined(__riscv) || \
|
|
|
+ (defined(ARCH_CPU_MIPS_FAMILY) && defined(ARCH_CPU_64_BITS))
|
|
|
// These give a lot of ambient authority and bypass the setuid sandbox.
|
|
|
bool SyscallSets::IsSystemVSharedMemory(int sysno) {
|
|
|
- switch (sysno) {
|
|
|
-@@ -932,7 +934,8 @@ bool SyscallSets::IsSystemVSharedMemory(int sysno) {
|
|
|
+@@ -932,7 +932,8 @@ bool SyscallSets::IsSystemVSharedMemory(int sysno) {
|
|
|
#endif
|
|
|
|
|
|
#if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
|
|
@@ -433,7 +431,7 @@ index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
bool SyscallSets::IsSystemVMessageQueue(int sysno) {
|
|
|
switch (sysno) {
|
|
|
case __NR_msgctl:
|
|
|
-@@ -963,7 +966,8 @@ bool SyscallSets::IsSystemVIpc(int sysno) {
|
|
|
+@@ -963,7 +964,8 @@ bool SyscallSets::IsSystemVIpc(int sysno) {
|
|
|
|
|
|
bool SyscallSets::IsAnySystemV(int sysno) {
|
|
|
#if defined(__x86_64__) || defined(__arm__) || defined(__aarch64__) || \
|
|
@@ -443,7 +441,7 @@ index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
return IsSystemVMessageQueue(sysno) || IsSystemVSemaphores(sysno) ||
|
|
|
IsSystemVSharedMemory(sysno);
|
|
|
#elif defined(__i386__) || \
|
|
|
-@@ -1000,7 +1004,7 @@ bool SyscallSets::IsAdvancedScheduler(int sysno) {
|
|
|
+@@ -1000,7 +1002,7 @@ bool SyscallSets::IsAdvancedScheduler(int sysno) {
|
|
|
bool SyscallSets::IsInotify(int sysno) {
|
|
|
switch (sysno) {
|
|
|
case __NR_inotify_add_watch:
|
|
@@ -452,7 +450,7 @@ index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
case __NR_inotify_init:
|
|
|
#endif
|
|
|
case __NR_inotify_init1:
|
|
|
-@@ -1138,7 +1142,7 @@ bool SyscallSets::IsMisc(int sysno) {
|
|
|
+@@ -1138,7 +1140,7 @@ bool SyscallSets::IsMisc(int sysno) {
|
|
|
#if defined(__x86_64__)
|
|
|
case __NR_tuxcall:
|
|
|
#endif
|
|
@@ -461,7 +459,7 @@ index b3cf6fc7e86f..5e0acc32c893 100644
|
|
|
case __NR_vserver:
|
|
|
#endif
|
|
|
return true;
|
|
|
-@@ -1173,6 +1177,17 @@ bool SyscallSets::IsArmPrivate(int sysno) {
|
|
|
+@@ -1173,6 +1175,17 @@ bool SyscallSets::IsArmPrivate(int sysno) {
|
|
|
}
|
|
|
#endif // defined(__arm__)
|
|
|
|
|
@@ -606,7 +604,7 @@ index f863cd005141..b6d7dac2cab4 100644
|
|
|
return syscall(__NR_clone, flags, child_stack, ptid, tls, ctid);
|
|
|
#endif
|
|
|
diff --git a/sandbox/linux/syscall_broker/broker_process.cc b/sandbox/linux/syscall_broker/broker_process.cc
|
|
|
-index 7dd4688011f9..6feb09aeedf2 100644
|
|
|
+index 7dd4688011f9..11422693463d 100644
|
|
|
--- a/sandbox/linux/syscall_broker/broker_process.cc
|
|
|
+++ b/sandbox/linux/syscall_broker/broker_process.cc
|
|
|
@@ -117,44 +117,46 @@ bool BrokerProcess::IsSyscallBrokerable(int sysno, bool fast_check) const {
|
|
@@ -646,7 +644,7 @@ index 7dd4688011f9..6feb09aeedf2 100644
|
|
|
+#if !defined(__aarch64__) && !BUILDFLAG(IS_ANDROID) && !defined(__riscv)
|
|
|
case __NR_rename:
|
|
|
#endif
|
|
|
-+#ifdef __NR_renameat:
|
|
|
++#ifdef __NR_renameat
|
|
|
case __NR_renameat:
|
|
|
+#endif
|
|
|
case __NR_renameat2:
|
|
@@ -749,10 +747,10 @@ index 2b78a0cc3b97..968d6f71b586 100644
|
|
|
|
|
|
diff --git a/sandbox/linux/system_headers/riscv64_linux_syscalls.h b/sandbox/linux/system_headers/riscv64_linux_syscalls.h
|
|
|
new file mode 100644
|
|
|
-index 000000000000..23533617a91b
|
|
|
+index 000000000000..f8fcd06bc2f2
|
|
|
--- /dev/null
|
|
|
+++ b/sandbox/linux/system_headers/riscv64_linux_syscalls.h
|
|
|
-@@ -0,0 +1,1070 @@
|
|
|
+@@ -0,0 +1,1074 @@
|
|
|
+// Copyright 2014 The Chromium Authors. All rights reserved.
|
|
|
+// Use of this source code is governed by a BSD-style license that can be
|
|
|
+// found in the LICENSE file.
|
|
@@ -1822,6 +1820,10 @@ index 000000000000..23533617a91b
|
|
|
+#define __NR_memfd_create 279
|
|
|
+#endif
|
|
|
+
|
|
|
++#if !defined(__NR_faccessat2)
|
|
|
++#define __NR_faccessat2 439
|
|
|
++#endif
|
|
|
++
|
|
|
+#endif // SANDBOX_LINUX_SYSTEM_HEADERS_RISCV64_LINUX_SYSCALLS_H_
|
|
|
diff --git a/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc b/sandbox/policy/linux/bpf_cros_amd_gpu_policy_linux.cc
|
|
|
index cd64d06ae39d..1dad48a7caae 100644
|