platform_bionic/libc/SECCOMP_PRIORITY.TXT

# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
# Note that the resultant policy is applied only to zygote spawned processes.
#
# This file is processed by a python script named genseccomp.py.
#
# The syscalls below are prioritized above other syscalls when checking seccomp policy, in
# the order of appearance in this file.

futex
ioctl
Use more inclusive language for seccomp filter blacklist and whitelist are replaced with blocklist and allowlist respectively. Test: CtsSeccompHostTestCases Change-Id: I39d9eda89038d1addbdaed59284a254a34cea1c6 2020-06-15 18:29:07 +02:00			`# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.`
Speed up seccomp with priority list. Allow to provide a list of prioritized syscalls (e.g., syscalls that we know occur often) which are checked before other syscalls in seccomp. When constructing the bpf seccomp filter, traverse prioritized syscalls in a linear list before checking all other syscalls in a binary tree. Bug: 156732794 Test: make, inspect generated *_system_policy.cpp files Test: simpleperf on futex/ioctl-heavy app seems to show 5-10% less time spent in seccomp call Change-Id: I509343bcd32ada90c0591785ab5cb12d2a38c31e (cherry picked from commit ce84677733c18bc442f7f1b2f1840117c904db70) 2020-05-06 13:49:55 +02:00			`# Note that the resultant policy is applied only to zygote spawned processes.`
			`#`
			`# This file is processed by a python script named genseccomp.py.`
			`#`
			`# The syscalls below are prioritized above other syscalls when checking seccomp policy, in`
			`# the order of appearance in this file.`

			`futex`
			`ioctl`