runtime_probe: fix socket syscall constraints in seccomp policy
After M74+ logging to /dev/log uses different type of transmitting
protocol. Update seccomp rules to accomodate this.
TEST=PROTO_BYTES=$(echo -e \
'categories:storage\ncategories:battery' \
| protoc --encode runtime_probe.ProbeRequest \
system_api/dbus/runtime_probe/runtime_probe.proto \
| hexdump -v -e '/1 "%d,"'); \
ssh root@$DEVICE_IP sudo -u chronos \
dbus-send --system --print-reply \
--type=method_call --dest=org.chromium.RuntimeProbe \
/org/chromium/RuntimeProbe org.chromium.RuntimeProbe.ProbeCategories \
array:byte:$PROTO_BYTES
BUG=b:132303928,b:119155505
Change-Id: Iea0f20bd2246950e1099ae8d3269fd26a92797bd
Reviewed-on: https://chromium-review.googlesource.com/1609629
Commit-Ready: Hong-Min Chu <hmchu@chromium.org>
Tested-by: Hong-Min Chu <hmchu@chromium.org>
Reviewed-by: Hong-Min Chu <hmchu@chromium.org>
(cherry picked from commit fc08315b0981ba2856d2dadb6700c049b26d244a)
Reviewed-on: https://chromium-review.googlesource.com/c/chromiumos/platform2/+/1669767
Commit-Queue: Hong-Min Chu <hmchu@chromium.org>
diff --git a/runtime_probe/seccomp/runtime_probe-seccomp-amd64.policy b/runtime_probe/seccomp/runtime_probe-seccomp-amd64.policy
index 63c8a64..39a74ab 100644
--- a/runtime_probe/seccomp/runtime_probe-seccomp-amd64.policy
+++ b/runtime_probe/seccomp/runtime_probe-seccomp-amd64.policy
@@ -75,7 +75,9 @@
wait4: 1
gettid: 1
getuid: 1
-socket: arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC && arg2 == 0
+# Here AF_UNIX + SOCK_STREAM is to allow dbus usage,
+# and AF_UNIX + SOCK_DGRAM is to allow logging to /dev/log
+socket: arg0 == AF_UNIX && arg1 == SOCK_STREAM|SOCK_CLOEXEC && arg2 == 0 || arg0 == AF_UNIX && arg1 == SOCK_DGRAM|SOCK_CLOEXEC && arg2 == 0
getresuid: 1
munmap: 1
pipe2: 1
