1# Copyright 2019 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Copyright 2019 The ChromiumOS Authors
6# Use of this source code is governed by a BSD-style license that can be
7# found in the LICENSE file.
8
9# This is an allow list of syscalls for most of crosvm devices.
10#
11# Note that some device policy files don't depend on this policy file
12# because of some conflicts such as gpu_common.policy.
13# If you want to modify policies for all the devices, please modify
14# not only this file but also other *_common.policy files.
15
16brk: 1
17clock_gettime: 1
18clone: arg0 & CLONE_THREAD
19clone3: 1
20close: 1
21dup3: 1
22dup: 1
23epoll_create1: 1
24epoll_ctl: 1
25epoll_pwait: 1
26eventfd2: 1
27exit: 1
28exit_group: 1
29ftruncate: 1
30futex: 1
31getcwd: 1
32getpid: 1
33gettid: 1
34gettimeofday: 1
35io_uring_setup: 1
36io_uring_register: 1
37io_uring_enter: 1
38kill: 1
39lseek: 1
40madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
41membarrier: 1
42memfd_create: 1
43mmap: arg2 in ~PROT_EXEC
44mprotect: arg2 in ~PROT_EXEC
45mremap: 1
46munmap: 1
47nanosleep: 1
48clock_nanosleep: 1
49pipe2: 1
50ppoll: 1
51read: 1
52readlinkat: 1
53readv: 1
54recvfrom: 1
55recvmsg: 1
56restart_syscall: 1
57rseq: 1
58rt_sigaction: 1
59rt_sigprocmask: 1
60rt_sigreturn: 1
61sched_getaffinity: 1
62sched_yield: 1
63sendmsg: 1
64sendto: 1
65set_robust_list: 1
66sigaltstack: 1
67tgkill: arg2 == SIGABRT
68write: 1
69writev: 1
70fcntl: 1
71uname: 1
72
73# ANDROID(b/271625758): disabled to fix duplicate syscall error.
74# ## Rules for vmm-swap
75# userfaultfd: 1
76# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
77# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
78
79copy_file_range: 1
80fallocate: 1
81fchdir: 1
82fchmod: 1
83fchmodat: 1
84fchown: 1
85fchownat: 1
86fdatasync: 1
87fgetxattr: 1
88getxattr: 1
89fsetxattr: 1
90setxattr: 1
91flistxattr: 1
92listxattr: 1
93fremovexattr: 1
94removexattr: 1
95fsync: 1
96newfstatat: 1
97fstatfs: 1
98getdents64: 1
99getegid: 1
100geteuid: 1
101getrandom: 1
102getresuid: 1
103# Use constants for verity ioctls since minijail doesn't understand them yet.
104# 0x40806685 = FS_IOC_ENABLE_VERITY
105# 0xc0046686 = FS_IOC_MEASURE_VERITY
106ioctl: arg1 == FS_IOC_FSGETXATTR || \
107arg1 == FS_IOC_FSSETXATTR || \
108arg1 == FS_IOC_GETFLAGS || \
109arg1 == FS_IOC_SETFLAGS || \
110arg1 == FS_IOC_GET_ENCRYPTION_POLICY_EX || \
111arg1 == 0x40806685 || \
112arg1 == 0xc0046686
113linkat: 1
114mkdirat: 1
115mknodat: 1
116openat: 1
117preadv: 1
118pwritev: 1
119renameat2: 1
120setresgid: 1
121setresuid: 1
122symlinkat: 1
123umask: 1
124unlinkat: 1
125utimensat: 1
126prctl: arg0 == PR_SET_NAME || arg0 == PR_SET_SECUREBITS || arg0 == PR_GET_SECUREBITS
127capget: 1
128capset: 1
129unshare: 1
130