| Victor Hsieh | dbb8670 | 2020-06-15 09:29:07 -0700 | [diff] [blame^] | 1 | # This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT. |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 2 | # Note that the resultant policy is applied only to zygote spawned processes. |
| 3 | # |
| Victor Hsieh | dbb8670 | 2020-06-15 09:29:07 -0700 | [diff] [blame^] | 4 | # The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT |
| 5 | # Any entry in the blocklist must be in the syscalls file and not be in the allowlist file |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 6 | # |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 7 | # This file is processed by a python script named genseccomp.py. |
| 8 | |
| Victor Hsieh | e15233c | 2018-03-28 16:30:20 -0700 | [diff] [blame] | 9 | # Note: Some privileged syscalls are still needed in app process after fork before uid change, |
| Martijn Coenen | e17fce1 | 2019-01-21 14:29:35 +0100 | [diff] [blame] | 10 | # including capset and setresuid. This is because the seccomp filter must be installed while |
| 11 | # the process still has CAP_SYS_ADMIN; changing the uid would remove that capability. |
| Victor Hsieh | e15233c | 2018-03-28 16:30:20 -0700 | [diff] [blame] | 12 | |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 13 | # syscalls to modify IDs |
| Elliott Hughes | 2b49904 | 2020-02-13 14:21:55 -0800 | [diff] [blame] | 14 | int setgid:setgid32(gid_t) lp32 |
| 15 | int setgid:setgid(gid_t) lp64 |
| 16 | int setuid:setuid32(uid_t) lp32 |
| 17 | int setuid:setuid(uid_t) lp64 |
| 18 | int setregid:setregid32(gid_t, gid_t) lp32 |
| 19 | int setregid:setregid(gid_t, gid_t) lp64 |
| 20 | int setreuid:setreuid32(uid_t, uid_t) lp32 |
| 21 | int setreuid:setreuid(uid_t, uid_t) lp64 |
| 22 | int setresgid:setresgid32(gid_t, gid_t, gid_t) lp32 |
| 23 | int setresgid:setresgid(gid_t, gid_t, gid_t) lp64 |
| Martijn Coenen | e17fce1 | 2019-01-21 14:29:35 +0100 | [diff] [blame] | 24 | # setresuid is explicitly allowed, see above. |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 25 | int setfsgid(gid_t) all |
| 26 | int setfsuid(uid_t) all |
| Elliott Hughes | 2b49904 | 2020-02-13 14:21:55 -0800 | [diff] [blame] | 27 | int setgroups:setgroups32(int, const gid_t*) lp32 |
| 28 | int setgroups:setgroups(int, const gid_t*) lp64 |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 29 | |
| 30 | # syscalls to modify times |
| 31 | int adjtimex(struct timex*) all |
| 32 | int clock_adjtime(clockid_t, struct timex*) all |
| 33 | int clock_settime(clockid_t, const struct timespec*) all |
| 34 | int settimeofday(const struct timeval*, const struct timezone*) all |
| 35 | |
| 36 | int acct(const char* filepath) all |
| 37 | int klogctl:syslog(int, char*, int) all |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 38 | int chroot(const char*) all |
| 39 | |
| 40 | # syscalls to change machine various configurations |
| 41 | int init_module(void*, unsigned long, const char*) all |
| 42 | int delete_module(const char*, unsigned int) all |
| 43 | int mount(const char*, const char*, const char*, unsigned long, const void*) all |
| 44 | int umount2(const char*, int) all |
| 45 | int swapon(const char*, int) all |
| 46 | int swapoff(const char*) all |
| 47 | int setdomainname(const char*, size_t) all |
| 48 | int sethostname(const char*, size_t) all |
| 49 | int __reboot:reboot(int, int, int, void*) all |