| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 1 | # This file is used to populate seccomp's whitelist policy in combination with SYSCALLS.TXT. |
| 2 | # Note that the resultant policy is applied only to zygote spawned processes. |
| 3 | # |
| 4 | # The final seccomp whitelist is SYSCALLS.TXT - SECCOMP_BLACKLIST.TXT + SECCOMP_WHITELIST.TXT |
| 5 | # Any entry in the blacklist must be in the syscalls file and not be in the whitelist file |
| 6 | # |
| 7 | # Each non-blank, non-comment line has the following format: |
| 8 | # |
| 9 | # return_type func_name[|alias_list][:syscall_name[:socketcall_id]]([parameter_list]) arch_list |
| 10 | # |
| 11 | # where: |
| 12 | # arch_list ::= "all" | arch+ |
| 13 | # arch ::= "arm" | "arm64" | "mips" | "mips64" | "x86" | "x86_64" |
| 14 | # |
| 15 | # Note: |
| 16 | # - syscall_name corresponds to the name of the syscall, which may differ from |
| 17 | # the exported function name (example: the exit syscall is implemented by the _exit() |
| 18 | # function, which is not the same as the standard C exit() function which calls it) |
| 19 | |
| 20 | # - alias_list is optional comma separated list of function aliases |
| 21 | # |
| 22 | # - The call_id parameter, given that func_name and syscall_name have |
| 23 | # been provided, allows the user to specify dispatch style syscalls. |
| 24 | # For example, socket() syscall on i386 actually becomes: |
| 25 | # socketcall(__NR_socket, 1, *(rest of args on stack)). |
| 26 | # |
| 27 | # - Each parameter type is assumed to be stored in 32 bits. |
| 28 | # |
| 29 | # This file is processed by a python script named genseccomp.py. |
| 30 | |
| Victor Hsieh | e15233c | 2018-03-28 16:30:20 -0700 | [diff] [blame] | 31 | # Note: Some privileged syscalls are still needed in app process after fork before uid change, |
| 32 | # including capset and setresuid. |
| 33 | |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 34 | # syscalls to modify IDs |
| 35 | int setgid:setgid32(gid_t) arm,x86 |
| 36 | int setgid:setgid(gid_t) arm64,mips,mips64,x86_64 |
| 37 | int setuid:setuid32(uid_t) arm,x86 |
| 38 | int setuid:setuid(uid_t) arm64,mips,mips64,x86_64 |
| 39 | int setreuid:setreuid32(uid_t, uid_t) arm,x86 |
| 40 | int setreuid:setreuid(uid_t, uid_t) arm64,mips,mips64,x86_64 |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 41 | int setresgid:setresgid32(gid_t, gid_t, gid_t) arm,x86 |
| 42 | int setresgid:setresgid(gid_t, gid_t, gid_t) arm64,mips,mips64,x86_64 |
| 43 | int setfsgid(gid_t) all |
| 44 | int setfsuid(uid_t) all |
| 45 | int setgroups:setgroups32(int, const gid_t*) arm,x86 |
| 46 | int setgroups:setgroups(int, const gid_t*) arm64,mips,mips64,x86_64 |
| 47 | |
| 48 | # syscalls to modify times |
| 49 | int adjtimex(struct timex*) all |
| 50 | int clock_adjtime(clockid_t, struct timex*) all |
| 51 | int clock_settime(clockid_t, const struct timespec*) all |
| 52 | int settimeofday(const struct timeval*, const struct timezone*) all |
| 53 | |
| 54 | int acct(const char* filepath) all |
| 55 | int klogctl:syslog(int, char*, int) all |
| Victor Hsieh | 2f23ced | 2018-01-17 16:59:12 -0800 | [diff] [blame] | 56 | int chroot(const char*) all |
| 57 | |
| 58 | # syscalls to change machine various configurations |
| 59 | int init_module(void*, unsigned long, const char*) all |
| 60 | int delete_module(const char*, unsigned int) all |
| 61 | int mount(const char*, const char*, const char*, unsigned long, const void*) all |
| 62 | int umount2(const char*, int) all |
| 63 | int swapon(const char*, int) all |
| 64 | int swapoff(const char*) all |
| 65 | int setdomainname(const char*, size_t) all |
| 66 | int sethostname(const char*, size_t) all |
| 67 | int __reboot:reboot(int, int, int, void*) all |