1*8d67ca89SAndroid Build Coastguard Worker# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT. 2*8d67ca89SAndroid Build Coastguard Worker# Note that the resultant policy is applied only to zygote spawned processes. 3*8d67ca89SAndroid Build Coastguard Worker# 4*8d67ca89SAndroid Build Coastguard Worker# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT 5*8d67ca89SAndroid Build Coastguard Worker# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file 6*8d67ca89SAndroid Build Coastguard Worker# 7*8d67ca89SAndroid Build Coastguard Worker# This file is processed by a python script named genseccomp.py. 8*8d67ca89SAndroid Build Coastguard Worker 9*8d67ca89SAndroid Build Coastguard Worker# Syscalls to modify IDs. 10*8d67ca89SAndroid Build Coastguard Worker# Note: Some privileged syscalls are still needed in app_process after fork but 11*8d67ca89SAndroid Build Coastguard Worker# before uid change, including capset and setresuid. This is because the seccomp 12*8d67ca89SAndroid Build Coastguard Worker# filter must be installed while the process still has CAP_SYS_ADMIN; changing 13*8d67ca89SAndroid Build Coastguard Worker# the uid would remove that capability. 14*8d67ca89SAndroid Build Coastguard Workerint setgid32(gid_t) lp32 15*8d67ca89SAndroid Build Coastguard Workerint setgid(gid_t) lp64 16*8d67ca89SAndroid Build Coastguard Workerint setuid32(uid_t) lp32 17*8d67ca89SAndroid Build Coastguard Workerint setuid(uid_t) lp64 18*8d67ca89SAndroid Build Coastguard Workerint setregid32(gid_t, gid_t) lp32 19*8d67ca89SAndroid Build Coastguard Workerint setregid(gid_t, gid_t) lp64 20*8d67ca89SAndroid Build Coastguard Workerint setreuid32(uid_t, uid_t) lp32 21*8d67ca89SAndroid Build Coastguard Workerint setreuid(uid_t, uid_t) lp64 22*8d67ca89SAndroid Build Coastguard Workerint setresgid32(gid_t, gid_t, gid_t) lp32 23*8d67ca89SAndroid Build Coastguard Workerint setresgid(gid_t, gid_t, gid_t) lp64 24*8d67ca89SAndroid Build Coastguard Worker# setresuid is explicitly allowed, see above. 25*8d67ca89SAndroid Build Coastguard Workerint setfsgid32(gid_t) lp32 26*8d67ca89SAndroid Build Coastguard Workerint setfsgid(gid_t) lp64 27*8d67ca89SAndroid Build Coastguard Workerint setfsuid32(uid_t) lp32 28*8d67ca89SAndroid Build Coastguard Workerint setfsuid(uid_t) lp64 29*8d67ca89SAndroid Build Coastguard Workerint setgroups32(int, const gid_t*) lp32 30*8d67ca89SAndroid Build Coastguard Workerint setgroups(int, const gid_t*) lp64 31*8d67ca89SAndroid Build Coastguard Worker 32*8d67ca89SAndroid Build Coastguard Worker# Syscalls to modify times. 33*8d67ca89SAndroid Build Coastguard Workerint adjtimex(struct timex*) all 34*8d67ca89SAndroid Build Coastguard Workerint clock_adjtime(clockid_t, struct timex*) all 35*8d67ca89SAndroid Build Coastguard Workerint clock_settime(clockid_t, const struct timespec*) all 36*8d67ca89SAndroid Build Coastguard Workerint settimeofday(const struct timeval*, const struct timezone*) all 37*8d67ca89SAndroid Build Coastguard Worker 38*8d67ca89SAndroid Build Coastguard Workerint acct(const char* filepath) all 39*8d67ca89SAndroid Build Coastguard Workerint syslog(int, char*, int) all 40*8d67ca89SAndroid Build Coastguard Workerint chroot(const char*) all 41*8d67ca89SAndroid Build Coastguard Worker 42*8d67ca89SAndroid Build Coastguard Workerint init_module(void*, unsigned long, const char*) all 43*8d67ca89SAndroid Build Coastguard Workerint delete_module(const char*, unsigned int) all 44*8d67ca89SAndroid Build Coastguard Workerint mount(const char*, const char*, const char*, unsigned long, const void*) all 45*8d67ca89SAndroid Build Coastguard Workerint umount2(const char*, int) all 46*8d67ca89SAndroid Build Coastguard Workerint swapon(const char*, int) all 47*8d67ca89SAndroid Build Coastguard Workerint swapoff(const char*) all 48*8d67ca89SAndroid Build Coastguard Workerint setdomainname(const char*, size_t) all 49*8d67ca89SAndroid Build Coastguard Workerint sethostname(const char*, size_t) all 50*8d67ca89SAndroid Build Coastguard Workerint reboot(int, int, int, void*) all 51