aa3f96c9c4
Enabling seccomp across all processes, rather than just zygote, is
useful for auditing the syscall usage of AOSP. Create a global seccomp
policy that can optionally be enabled by init.
Bug: 37960259
Test: confirm global seccomp by removing finit_module from policy and
observing modprobe fail, confirm regular seccomp unchanged by
comparing length of installed bpf
Change-Id: Iac53a42fa26a80b05126f262dd9525f4f66df558
25 lines
615 B
Text
25 lines
615 B
Text
cc_library {
|
|
name: "libseccomp_policy",
|
|
srcs: [
|
|
"seccomp_policy.cpp",
|
|
"arm_policy.cpp",
|
|
"arm_global_policy.cpp",
|
|
"arm64_policy.cpp",
|
|
"arm64_global_policy.cpp",
|
|
"x86_policy.cpp",
|
|
"x86_global_policy.cpp",
|
|
"x86_64_policy.cpp",
|
|
"x86_64_global_policy.cpp",
|
|
"mips_policy.cpp",
|
|
"mips_global_policy.cpp",
|
|
"mips64_policy.cpp",
|
|
"mips64_global_policy.cpp",
|
|
],
|
|
export_include_dirs: ["include"],
|
|
shared: {
|
|
shared_libs: ["libbase"],
|
|
},
|
|
static: {
|
|
static_libs: ["libbase"],
|
|
},
|
|
}
|