xref: /aosp_15_r20/bionic/libc/SECCOMP_BLOCKLIST_APP.TXT (revision 8d67ca893c1523eb926b9080dbe4e2ffd2a27ba1)
1*8d67ca89SAndroid Build Coastguard Worker# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
2*8d67ca89SAndroid Build Coastguard Worker# Note that the resultant policy is applied only to zygote spawned processes.
3*8d67ca89SAndroid Build Coastguard Worker#
4*8d67ca89SAndroid Build Coastguard Worker# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT
5*8d67ca89SAndroid Build Coastguard Worker# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file
6*8d67ca89SAndroid Build Coastguard Worker#
7*8d67ca89SAndroid Build Coastguard Worker# This file is processed by a python script named genseccomp.py.
8*8d67ca89SAndroid Build Coastguard Worker
9*8d67ca89SAndroid Build Coastguard Worker# Syscalls to modify IDs.
10*8d67ca89SAndroid Build Coastguard Worker# Note: Some privileged syscalls are still needed in app_process after fork but
11*8d67ca89SAndroid Build Coastguard Worker# before uid change, including capset and setresuid. This is because the seccomp
12*8d67ca89SAndroid Build Coastguard Worker# filter must be installed while the process still has CAP_SYS_ADMIN; changing
13*8d67ca89SAndroid Build Coastguard Worker# the uid would remove that capability.
14*8d67ca89SAndroid Build Coastguard Workerint     setgid32(gid_t)     lp32
15*8d67ca89SAndroid Build Coastguard Workerint     setgid(gid_t)       lp64
16*8d67ca89SAndroid Build Coastguard Workerint     setuid32(uid_t)    lp32
17*8d67ca89SAndroid Build Coastguard Workerint     setuid(uid_t)      lp64
18*8d67ca89SAndroid Build Coastguard Workerint     setregid32(gid_t, gid_t)  lp32
19*8d67ca89SAndroid Build Coastguard Workerint     setregid(gid_t, gid_t)    lp64
20*8d67ca89SAndroid Build Coastguard Workerint     setreuid32(uid_t, uid_t)   lp32
21*8d67ca89SAndroid Build Coastguard Workerint     setreuid(uid_t, uid_t)     lp64
22*8d67ca89SAndroid Build Coastguard Workerint     setresgid32(gid_t, gid_t, gid_t)   lp32
23*8d67ca89SAndroid Build Coastguard Workerint     setresgid(gid_t, gid_t, gid_t)     lp64
24*8d67ca89SAndroid Build Coastguard Worker# setresuid is explicitly allowed, see above.
25*8d67ca89SAndroid Build Coastguard Workerint     setfsgid32(gid_t) lp32
26*8d67ca89SAndroid Build Coastguard Workerint     setfsgid(gid_t)   lp64
27*8d67ca89SAndroid Build Coastguard Workerint     setfsuid32(uid_t) lp32
28*8d67ca89SAndroid Build Coastguard Workerint     setfsuid(uid_t)   lp64
29*8d67ca89SAndroid Build Coastguard Workerint     setgroups32(int, const gid_t*)   lp32
30*8d67ca89SAndroid Build Coastguard Workerint     setgroups(int, const gid_t*)     lp64
31*8d67ca89SAndroid Build Coastguard Worker
32*8d67ca89SAndroid Build Coastguard Worker# Syscalls to modify times.
33*8d67ca89SAndroid Build Coastguard Workerint     adjtimex(struct timex*)   all
34*8d67ca89SAndroid Build Coastguard Workerint     clock_adjtime(clockid_t, struct timex*)   all
35*8d67ca89SAndroid Build Coastguard Workerint     clock_settime(clockid_t, const struct timespec*)  all
36*8d67ca89SAndroid Build Coastguard Workerint     settimeofday(const struct timeval*, const struct timezone*)   all
37*8d67ca89SAndroid Build Coastguard Worker
38*8d67ca89SAndroid Build Coastguard Workerint     acct(const char*  filepath)  all
39*8d67ca89SAndroid Build Coastguard Workerint     syslog(int, char*, int)   all
40*8d67ca89SAndroid Build Coastguard Workerint     chroot(const char*)  all
41*8d67ca89SAndroid Build Coastguard Worker
42*8d67ca89SAndroid Build Coastguard Workerint     init_module(void*, unsigned long, const char*)  all
43*8d67ca89SAndroid Build Coastguard Workerint     delete_module(const char*, unsigned int)   all
44*8d67ca89SAndroid Build Coastguard Workerint     mount(const char*, const char*, const char*, unsigned long, const void*)  all
45*8d67ca89SAndroid Build Coastguard Workerint     umount2(const char*, int)  all
46*8d67ca89SAndroid Build Coastguard Workerint     swapon(const char*, int) all
47*8d67ca89SAndroid Build Coastguard Workerint     swapoff(const char*) all
48*8d67ca89SAndroid Build Coastguard Workerint     setdomainname(const char*, size_t)  all
49*8d67ca89SAndroid Build Coastguard Workerint     sethostname(const char*, size_t)  all
50*8d67ca89SAndroid Build Coastguard Workerint     reboot(int, int, int, void*)  all
51