blob: b9ecc02474421db8b49a6b8577198d27dcc5141a [file] [log] [blame]
# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
# Note that the resultant policy is applied only to zygote spawned processes.
#
# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT
# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file
#
# This file is processed by a python script named genseccomp.py.
# Syscalls to modify IDs.
# Note: Some privileged syscalls are still needed in app_process after fork but
# before uid change, including capset and setresuid. This is because the seccomp
# filter must be installed while the process still has CAP_SYS_ADMIN; changing
# the uid would remove that capability.
int setgid32(gid_t) lp32
int setgid(gid_t) lp64
int setuid32(uid_t) lp32
int setuid(uid_t) lp64
int setregid32(gid_t, gid_t) lp32
int setregid(gid_t, gid_t) lp64
int setreuid32(uid_t, uid_t) lp32
int setreuid(uid_t, uid_t) lp64
int setresgid32(gid_t, gid_t, gid_t) lp32
int setresgid(gid_t, gid_t, gid_t) lp64
# setresuid is explicitly allowed, see above.
int setfsgid32(gid_t) lp32
int setfsgid(gid_t) lp64
int setfsuid32(uid_t) lp32
int setfsuid(uid_t) lp64
int setgroups32(int, const gid_t*) lp32
int setgroups(int, const gid_t*) lp64
# Syscalls to modify times.
int adjtimex(struct timex*) all
int clock_adjtime(clockid_t, struct timex*) all
int clock_settime(clockid_t, const struct timespec*) all
int settimeofday(const struct timeval*, const struct timezone*) all
int acct(const char* filepath) all
int syslog(int, char*, int) all
int chroot(const char*) all
int init_module(void*, unsigned long, const char*) all
int delete_module(const char*, unsigned int) all
int mount(const char*, const char*, const char*, unsigned long, const void*) all
int umount2(const char*, int) all
int swapon(const char*, int) all
int swapoff(const char*) all
int setdomainname(const char*, size_t) all
int sethostname(const char*, size_t) all
int reboot(int, int, int, void*) all