1# Copyright 2021 The Chromium OS Authors. All rights reserved.
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Rules from common_device.policy with some rules removed because they block certain flags needed
6# for gpu.
7brk: 1
8clock_gettime: 1
9close: 1
10dup3: 1
11dup: 1
12epoll_create1: 1
13epoll_ctl: 1
14epoll_pwait: 1
15eventfd2: 1
16exit: 1
17exit_group: 1
18futex: 1
19getcwd: 1
20getpid: 1
21gettid: 1
22gettimeofday: 1
23io_uring_setup: 1
24io_uring_enter: 1
25kill: 1
26madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE
27mremap: 1
28munmap: 1
29nanosleep: 1
30clock_nanosleep: 1
31pipe2: 1
32ppoll: 1
33read: 1
34readlinkat: 1
35readv: 1
36recvfrom: 1
37recvmsg: 1
38restart_syscall: 1
39rt_sigaction: 1
40rt_sigprocmask: 1
41rt_sigreturn: 1
42sched_getaffinity: 1
43sched_yield: 1
44sendmsg: 1
45sendto: 1
46set_robust_list: 1
47sigaltstack: 1
48write: 1
49writev: 1
50uname: 1
51
52# Required for perfetto tracing
53getsockopt: 1
54shutdown: 1
55
56## Rules specific to gpu
57connect: 1
58getrandom: 1
59lseek: 1
60ftruncate: 1
61statx: 1
62fstat: 1
63newfstatat: 1
64getdents64: 1
65sysinfo: 1
66fstatfs: 1
67prctl: arg0 == PR_SET_NAME || arg0 == PR_GET_NAME
68
69# 0x6400 == DRM_IOCTL_BASE, 0x8000 = KBASE_IOCTL_TYPE (mali), 0x40086200 = DMA_BUF_IOCTL_SYNC, 0x40087543 == UDMABUF_CREATE_LIST
70ioctl: arg1 & 0x6400 || arg1 & 0x8000 || arg1 == 0x40086200 || arg1 == 0x40087543
71
72# Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING
73memfd_create: arg1 == 3
74
75## mmap/mprotect differ from the common_device.policy
76mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ
77mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ
78openat: 1
79
80## Rules specific to pvr
81geteuid: 1
82getuid: 1
83fcntl: 1
84tgkill: 1
85
86# Rules specific to Mesa.
87sched_setscheduler: 1
88sched_setaffinity: 1
89kcmp: 1
90
91# Rules for Vulkan loader / layers
92faccessat: 1
93faccessat2: 1
94getgid: 1
95getegid: 1
96clone3: 1
97rseq: 1
98