| # This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT. |
| # Note that the resultant policy is applied only to zygote spawned processes. |
| # |
| # The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT |
| # Any entry in the blocklist must be in the syscalls file and not be in the allowlist file |
| # |
| # This file is processed by a python script named genseccomp.py. |
| |
| # Syscalls to modify IDs. |
| # Note: Some privileged syscalls are still needed in app_process after fork but |
| # before uid change, including capset and setresuid. This is because the seccomp |
| # filter must be installed while the process still has CAP_SYS_ADMIN; changing |
| # the uid would remove that capability. |
| int setgid32(gid_t) lp32 |
| int setgid(gid_t) lp64 |
| int setuid32(uid_t) lp32 |
| int setuid(uid_t) lp64 |
| int setregid32(gid_t, gid_t) lp32 |
| int setregid(gid_t, gid_t) lp64 |
| int setreuid32(uid_t, uid_t) lp32 |
| int setreuid(uid_t, uid_t) lp64 |
| int setresgid32(gid_t, gid_t, gid_t) lp32 |
| int setresgid(gid_t, gid_t, gid_t) lp64 |
| # setresuid is explicitly allowed, see above. |
| int setfsgid32(gid_t) lp32 |
| int setfsgid(gid_t) lp64 |
| int setfsuid32(uid_t) lp32 |
| int setfsuid(uid_t) lp64 |
| int setgroups32(int, const gid_t*) lp32 |
| int setgroups(int, const gid_t*) lp64 |
| |
| # Syscalls to modify times. |
| int adjtimex(struct timex*) all |
| int clock_adjtime(clockid_t, struct timex*) all |
| int clock_settime(clockid_t, const struct timespec*) all |
| int settimeofday(const struct timeval*, const struct timezone*) all |
| |
| int acct(const char* filepath) all |
| int syslog(int, char*, int) all |
| int chroot(const char*) all |
| |
| int init_module(void*, unsigned long, const char*) all |
| int delete_module(const char*, unsigned int) all |
| int mount(const char*, const char*, const char*, unsigned long, const void*) all |
| int umount2(const char*, int) all |
| int swapon(const char*, int) all |
| int swapoff(const char*) all |
| int setdomainname(const char*, size_t) all |
| int sethostname(const char*, size_t) all |
| int reboot(int, int, int, void*) all |