Use more inclusive language for seccomp filter
blacklist and whitelist are replaced with blocklist and allowlist
respectively.
Test: CtsSeccompHostTestCases
Change-Id: I39d9eda89038d1addbdaed59284a254a34cea1c6
diff --git a/libc/SECCOMP_BLOCKLIST_APP.TXT b/libc/SECCOMP_BLOCKLIST_APP.TXT
new file mode 100644
index 0000000..f14e11c
--- /dev/null
+++ b/libc/SECCOMP_BLOCKLIST_APP.TXT
@@ -0,0 +1,49 @@
+# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
+# Note that the resultant policy is applied only to zygote spawned processes.
+#
+# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT
+# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file
+#
+# This file is processed by a python script named genseccomp.py.
+
+# Note: Some privileged syscalls are still needed in app process after fork before uid change,
+# including capset and setresuid. This is because the seccomp filter must be installed while
+# the process still has CAP_SYS_ADMIN; changing the uid would remove that capability.
+
+# syscalls to modify IDs
+int setgid:setgid32(gid_t) lp32
+int setgid:setgid(gid_t) lp64
+int setuid:setuid32(uid_t) lp32
+int setuid:setuid(uid_t) lp64
+int setregid:setregid32(gid_t, gid_t) lp32
+int setregid:setregid(gid_t, gid_t) lp64
+int setreuid:setreuid32(uid_t, uid_t) lp32
+int setreuid:setreuid(uid_t, uid_t) lp64
+int setresgid:setresgid32(gid_t, gid_t, gid_t) lp32
+int setresgid:setresgid(gid_t, gid_t, gid_t) lp64
+# setresuid is explicitly allowed, see above.
+int setfsgid(gid_t) all
+int setfsuid(uid_t) all
+int setgroups:setgroups32(int, const gid_t*) lp32
+int setgroups:setgroups(int, const gid_t*) lp64
+
+# syscalls to modify times
+int adjtimex(struct timex*) all
+int clock_adjtime(clockid_t, struct timex*) all
+int clock_settime(clockid_t, const struct timespec*) all
+int settimeofday(const struct timeval*, const struct timezone*) all
+
+int acct(const char* filepath) all
+int klogctl:syslog(int, char*, int) all
+int chroot(const char*) all
+
+# syscalls to change machine various configurations
+int init_module(void*, unsigned long, const char*) all
+int delete_module(const char*, unsigned int) all
+int mount(const char*, const char*, const char*, unsigned long, const void*) all
+int umount2(const char*, int) all
+int swapon(const char*, int) all
+int swapoff(const char*) all
+int setdomainname(const char*, size_t) all
+int sethostname(const char*, size_t) all
+int __reboot:reboot(int, int, int, void*) all