1# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
2# Note that the resultant policy is applied only to zygote spawned processes.
3#
4# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT
5# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file
6#
7# This file is processed by a python script named genseccomp.py.
8
9# Note: Some privileged syscalls are still needed in app process after fork before uid change,
10# including capset and setresuid. This is because the seccomp filter must be installed while
11# the process still has CAP_SYS_ADMIN; changing the uid would remove that capability.
12
13# syscalls to modify IDs
14int     setgid:setgid32(gid_t)     lp32
15int     setgid:setgid(gid_t)       lp64
16int     setuid:setuid32(uid_t)    lp32
17int     setuid:setuid(uid_t)      lp64
18int     setregid:setregid32(gid_t, gid_t)  lp32
19int     setregid:setregid(gid_t, gid_t)    lp64
20int     setreuid:setreuid32(uid_t, uid_t)   lp32
21int     setreuid:setreuid(uid_t, uid_t)     lp64
22int     setresgid:setresgid32(gid_t, gid_t, gid_t)   lp32
23int     setresgid:setresgid(gid_t, gid_t, gid_t)     lp64
24# setresuid is explicitly allowed, see above.
25int     setfsgid:setfsgid32(gid_t) lp32
26int     setfsgid:setfsgid(gid_t)   lp64
27int     setfsuid:setfsuid32(uid_t) lp32
28int     setfsuid:setfsuid(uid_t)   lp64
29int     setgroups:setgroups32(int, const gid_t*)   lp32
30int     setgroups:setgroups(int, const gid_t*)     lp64
31
32# syscalls to modify times
33int     adjtimex(struct timex*)   all
34int     clock_adjtime(clockid_t, struct timex*)   all
35int     clock_settime(clockid_t, const struct timespec*)  all
36int     settimeofday(const struct timeval*, const struct timezone*)   all
37
38int     acct(const char*  filepath)  all
39int     klogctl:syslog(int, char*, int)   all
40int     chroot(const char*)  all
41
42# syscalls to change machine various configurations
43int     init_module(void*, unsigned long, const char*)  all
44int     delete_module(const char*, unsigned int)   all
45int     mount(const char*, const char*, const char*, unsigned long, const void*)  all
46int     umount2(const char*, int)  all
47int     swapon(const char*, int) all
48int     swapoff(const char*) all
49int     setdomainname(const char*, size_t)  all
50int     sethostname(const char*, size_t)  all
51int     __reboot:reboot(int, int, int, void*)  all
52