| From 6da03c4a5093e3fc9f09fa4c295e27b1df4d3091 Mon Sep 17 00:00:00 2001 |
| From: Lepton Wu <lepton@chromium.org> |
| Date: Fri, 6 Dec 2019 14:22:41 -0800 |
| Subject: [PATCH] betty-arcvm: Loose mprotect/mmap for software rendering |
| |
| betty-arcvm will use llvmpipe for graphics, and llvmpipe needs to |
| execute dynamically generated code. |
| |
| Change-Id: Ia7b213056e0bdcdfa2a2026f512dc39badaa04a1 |
| --- |
| seccomp/x86_64/gpu_device.policy | 4 ++-- |
| 1 file changed, 2 insertions(+), 2 deletions(-) |
| |
| diff --git a/seccomp/x86_64/gpu_device.policy b/seccomp/x86_64/gpu_device.policy |
| index b98dbd2..bf0184c 100644 |
| --- a/seccomp/x86_64/gpu_device.policy |
| +++ b/seccomp/x86_64/gpu_device.policy |
| @@ -61,8 +61,8 @@ lstat: 1 |
| # Used for sharing memory with wayland. arg1 == MFD_CLOEXEC|MFD_ALLOW_SEALING |
| memfd_create: arg1 == 3 |
| # mmap/mprotect/open/openat differ from the common_device.policy |
| -mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ |
| -mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ |
| +mmap: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ|PROT_EXEC || arg2 == PROT_WRITE || arg2 == PROT_READ || arg2 == PROT_READ|PROT_WRITE|PROT_EXEC |
| +mprotect: arg2 == PROT_READ|PROT_WRITE || arg2 == PROT_NONE || arg2 == PROT_READ || arg2 == PROT_READ|PROT_EXEC |
| open: 1 |
| openat: 1 |
| readlink: 1 |
| -- |
| 2.24.1.735.g03f4e72817-goog |
| |
