seccomp: Add riscv64 policies

Add a basic starting point for riscv64.

constants generated with a slightly modified gerneate_constants script
to run on a riscv64 native system as there isn't a chroot for that:)

TEST: with the rest of the series applied, boot an ubuntu riscv64 VM
using crosvm from a riscv64 host with sandboxeing emabled.

Change-Id: I1ae7db4204df2ffdf1666ebc3e955a97d812f92a
Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4460940
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
Reviewed-by: Daniel Verkamp <dverkamp@chromium.org>

Author: dgreid

jail/seccomp/generate_constants.sh

@@ -22,7 +22,7 @@ cleanup() {
 trap cleanup EXIT
 
 # Create bindings for each platform
-for arch in "x86_64" "arm" "aarch64"; do
+for arch in "x86_64" "arm" "aarch64" "riscv64"; do
     BUILD_DIR="$TMP_DIR/$arch"
     mkdir -p "$BUILD_DIR"
     cd "$BUILD_DIR"
@@ -37,6 +37,9 @@ for arch in "x86_64" "arm" "aarch64"; do
     elif [ "$arch" = "aarch64" ]; then
         export CC="aarch64-linux-gnu-gcc"
         TARGET="aarch64-unknown-linux-gnu"
+    elif [ "$arch" = "riscv64" ]; then
+        export CC="riscv64-unknown-linux-gnu-gcc"
+        TARGET="riscv64-unknown-linux-gnu"
     fi
 
     "$MINIJAIL_DIR/gen_constants.sh" "libconstants.gen.c"

jail/seccomp/riscv64/9p_device.policy

@@ -0,0 +1,28 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+openat: 1
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+pread64: 1
+pwrite64: 1
+statx: 1
+fstat: 1
+ioctl: arg1 == FIOCLEX
+getdents64: 1
+fdatasync: 1
+fsync: 1
+mkdirat: 1
+linkat: 1
+unlinkat: 1
+socket: arg0 == AF_UNIX
+utimensat: 1
+fchmod: 1
+fchmodat: 1
+fchown: 1
+fchownat: 1
+fstatfs: 1
+newfstatat: 1
+prctl: arg0 == PR_SET_NAME

jail/seccomp/riscv64/balloon_device.policy

@@ -0,0 +1,8 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+openat: return ENOENT
+prctl: arg0 == PR_SET_NAME

jail/seccomp/riscv64/battery.policy

@@ -0,0 +1,10 @@
+# Copyright 2020 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+connect: 1
+geteuid: 1
+getsockname: 1
+prctl: arg0 == PR_SET_NAME
+socket: arg0 == AF_UNIX

jail/seccomp/riscv64/block_device.policy

@@ -0,0 +1,19 @@
+# Copyright 2019 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+@include /usr/share/policy/crosvm/common_device.policy
+
+fallocate: 1
+fdatasync: 1
+fstat: 1
+fsync: 1
+openat: return ENOENT
+newfstatat: 1
+preadv: 1
+pwritev: 1
+statx: 1
+timerfd_create: 1
+timerfd_gettime: 1
+timerfd_settime: 1
+prctl: arg0 == PR_SET_NAME

jail/seccomp/riscv64/common_device.policy

@@ -0,0 +1,60 @@
+# Copyright 2023 The ChromiumOS Authors
+# Use of this source code is governed by a BSD-style license that can be
+# found in the LICENSE file.
+
+brk: 1
+clock_gettime: 1
+clone: arg0 & CLONE_THREAD
+clone3: 1
+close: 1
+dup3: 1
+dup: 1
+epoll_create1: 1
+epoll_ctl: 1
+epoll_pwait: 1
+eventfd2: 1
+exit: 1
+exit_group: 1
+ftruncate: 1
+futex: 1
+getcwd: 1
+getpid: 1
+gettid: 1
+gettimeofday: 1
+io_uring_setup: 1
+io_uring_register: 1
+io_uring_enter: 1
+kill: 1
+lseek: 1
+madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
+membarrier: 1
+memfd_create: 1
+mmap: arg2 in ~PROT_EXEC
+mprotect: arg2 in ~PROT_EXEC
+mremap: 1
+munmap: 1
+nanosleep: 1
+clock_nanosleep: 1
+pipe2: 1
+ppoll: 1
+read: 1
+readlinkat: 1
+readv: 1
+recvfrom: 1
+recvmsg: 1
+restart_syscall: 1
+rseq: 1
+rt_sigaction: 1
+rt_sigprocmask: 1
+rt_sigreturn: 1
+sched_getaffinity: 1
+sched_yield: 1
+sendmsg: 1
+sendto: 1
+set_robust_list: 1
+sigaltstack: 1
+tgkill: arg2 == SIGABRT
+write: 1
+writev: 1
+fcntl: 1
+uname: 1