2020-06-15 18:29:07 +02:00
|
|
|
# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
|
2018-01-18 01:59:12 +01:00
|
|
|
# Note that the resultant policy is applied only to zygote spawned processes.
|
|
|
|
|
#
|
2020-06-15 18:29:07 +02:00
|
|
|
# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT
|
|
|
|
|
# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file
|
2018-01-18 01:59:12 +01:00
|
|
|
#
|
|
|
|
|
# This file is processed by a python script named genseccomp.py.
|
|
|
|
|
|
2018-03-29 01:30:20 +02:00
|
|
|
# Note: Some privileged syscalls are still needed in app process after fork before uid change,
|
2019-01-21 14:29:35 +01:00
|
|
|
# including capset and setresuid. This is because the seccomp filter must be installed while
|
|
|
|
|
# the process still has CAP_SYS_ADMIN; changing the uid would remove that capability.
|
2018-03-29 01:30:20 +02:00
|
|
|
|
2018-01-18 01:59:12 +01:00
|
|
|
# syscalls to modify IDs
|
2020-02-13 23:21:55 +01:00
|
|
|
int setgid:setgid32(gid_t) lp32
|
|
|
|
|
int setgid:setgid(gid_t) lp64
|
|
|
|
|
int setuid:setuid32(uid_t) lp32
|
|
|
|
|
int setuid:setuid(uid_t) lp64
|
|
|
|
|
int setregid:setregid32(gid_t, gid_t) lp32
|
|
|
|
|
int setregid:setregid(gid_t, gid_t) lp64
|
|
|
|
|
int setreuid:setreuid32(uid_t, uid_t) lp32
|
|
|
|
|
int setreuid:setreuid(uid_t, uid_t) lp64
|
|
|
|
|
int setresgid:setresgid32(gid_t, gid_t, gid_t) lp32
|
|
|
|
|
int setresgid:setresgid(gid_t, gid_t, gid_t) lp64
|
2019-01-21 14:29:35 +01:00
|
|
|
# setresuid is explicitly allowed, see above.
|
2023-02-04 00:10:04 +01:00
|
|
|
int setfsgid:setfsgid32(gid_t) lp32
|
|
|
|
|
int setfsgid:setfsgid(gid_t) lp64
|
|
|
|
|
int setfsuid:setfsuid32(uid_t) lp32
|
|
|
|
|
int setfsuid:setfsuid(uid_t) lp64
|
2020-02-13 23:21:55 +01:00
|
|
|
int setgroups:setgroups32(int, const gid_t*) lp32
|
|
|
|
|
int setgroups:setgroups(int, const gid_t*) lp64
|
2018-01-18 01:59:12 +01:00
|
|
|
|
|
|
|
|
# syscalls to modify times
|
|
|
|
|
int adjtimex(struct timex*) all
|
|
|
|
|
int clock_adjtime(clockid_t, struct timex*) all
|
|
|
|
|
int clock_settime(clockid_t, const struct timespec*) all
|
|
|
|
|
int settimeofday(const struct timeval*, const struct timezone*) all
|
|
|
|
|
|
|
|
|
|
int acct(const char* filepath) all
|
|
|
|
|
int klogctl:syslog(int, char*, int) all
|
|
|
|
|
int chroot(const char*) all
|
|
|
|
|
|
|
|
|
|
# syscalls to change machine various configurations
|
|
|
|
|
int init_module(void*, unsigned long, const char*) all
|
|
|
|
|
int delete_module(const char*, unsigned int) all
|
|
|
|
|
int mount(const char*, const char*, const char*, unsigned long, const void*) all
|
|
|
|
|
int umount2(const char*, int) all
|
|
|
|
|
int swapon(const char*, int) all
|
|
|
|
|
int swapoff(const char*) all
|
|
|
|
|
int setdomainname(const char*, size_t) all
|
|
|
|
|
int sethostname(const char*, size_t) all
|
|
|
|
|
int __reboot:reboot(int, int, int, void*) all
|
