1# Copyright 2019 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5openat: 1
6
7# Copyright 2019 The ChromiumOS Authors
8# Use of this source code is governed by a BSD-style license that can be
9# found in the LICENSE file.
10
11# This is an allow list of syscalls for most of crosvm devices.
12#
13# Note that some device policy files don't depend on this policy file
14# because of some conflicts such as gpu_common.policy.
15# If you want to modify policies for all the devices, please modify
16# not only this file but also other *_common.policy files.
17
18brk: 1
19clock_gettime: 1
20clone: arg0 & CLONE_THREAD
21clone3: 1
22close: 1
23dup3: 1
24dup: 1
25epoll_create1: 1
26epoll_ctl: 1
27epoll_pwait: 1
28eventfd2: 1
29exit: 1
30exit_group: 1
31ftruncate: 1
32futex: 1
33getcwd: 1
34getpid: 1
35gettid: 1
36gettimeofday: 1
37io_uring_setup: 1
38io_uring_register: 1
39io_uring_enter: 1
40kill: 1
41lseek: 1
42madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
43membarrier: 1
44memfd_create: 1
45mmap: arg2 in ~PROT_EXEC
46mprotect: arg2 in ~PROT_EXEC
47mremap: 1
48munmap: 1
49nanosleep: 1
50clock_nanosleep: 1
51pipe2: 1
52ppoll: 1
53read: 1
54readlinkat: 1
55readv: 1
56recvfrom: 1
57recvmsg: 1
58restart_syscall: 1
59rseq: 1
60rt_sigaction: 1
61rt_sigprocmask: 1
62rt_sigreturn: 1
63sched_getaffinity: 1
64sched_yield: 1
65sendmsg: 1
66sendto: 1
67set_robust_list: 1
68sigaltstack: 1
69tgkill: arg2 == SIGABRT
70write: 1
71writev: 1
72fcntl: 1
73uname: 1
74
75# ANDROID(b/271625758): disabled to fix duplicate syscall error.
76# ## Rules for vmm-swap
77# userfaultfd: 1
78# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
79# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
80
81pread64: 1
82pwrite64: 1
83statx: 1
84fstat: 1
85ioctl: arg1 == FIOCLEX
86getdents64: 1
87fdatasync: 1
88fsync: 1
89mkdirat: 1
90renameat: 1
91linkat: 1
92unlinkat: 1
93socket: arg0 == AF_UNIX
94utimensat: 1
95fchmod: 1
96fchmodat: 1
97fchown: 1
98fchownat: 1
99fstatfs: 1
100newfstatat: 1
101prctl: arg0 == PR_SET_NAME
102