Enable seccomp in init with generated policy
Test: Ran script to test performance - https://b.corp.google.com/issues/32313202#comment3
Saw no significant regression with this change on or off
Removed chroot from SYSCALLS.TXT - chroot blocked
Boot time appears reasonable
Device boots with no SECCOMP blockings
Measured per syscall time of 100ns
Empirically counted <100,000 syscalls a second under heavy load
Bug: 32313202
Change-Id: Icfcfbcb72b2de1b38f1ad6a82e8ece3bd1c9e7ec
diff --git a/init/init.cpp b/init/init.cpp
index ee5add8..75d8bc7 100644
--- a/init/init.cpp
+++ b/init/init.cpp
@@ -62,6 +62,7 @@
#include "keychords.h"
#include "log.h"
#include "property_service.h"
+#include "seccomp.h"
#include "service.h"
#include "signal_handler.h"
#include "ueventd.h"
@@ -763,6 +764,12 @@
// Now set up SELinux for second stage.
selinux_initialize(false);
+
+ // Install system-wide seccomp filter
+ if (!set_seccomp_filter()) {
+ LOG(ERROR) << "Failed to set seccomp policy";
+ security_failure();
+ }
}
// These directories were necessarily created before initial policy load