1# Copyright 2019 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Copyright 2019 The ChromiumOS Authors
6# Use of this source code is governed by a BSD-style license that can be
7# found in the LICENSE file.
8
9# This is an allow list of syscalls for most of crosvm devices.
10#
11# Note that some device policy files don't depend on this policy file
12# because of some conflicts such as gpu_common.policy.
13# If you want to modify policies for all the devices, please modify
14# not only this file but also other *_common.policy files.
15
16brk: 1
17clock_gettime: 1
18clone: arg0 & CLONE_THREAD
19clone3: 1
20close: 1
21dup3: 1
22dup: 1
23epoll_create1: 1
24epoll_ctl: 1
25epoll_pwait: 1
26eventfd2: 1
27exit: 1
28exit_group: 1
29ftruncate: 1
30futex: 1
31getcwd: 1
32getpid: 1
33gettid: 1
34gettimeofday: 1
35io_uring_setup: 1
36io_uring_register: 1
37io_uring_enter: 1
38kill: 1
39lseek: 1
40madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
41membarrier: 1
42memfd_create: 1
43mmap: arg2 in ~PROT_EXEC
44mprotect: arg2 in ~PROT_EXEC
45mremap: 1
46munmap: 1
47nanosleep: 1
48clock_nanosleep: 1
49pipe2: 1
50ppoll: 1
51read: 1
52readlinkat: 1
53readv: 1
54recvfrom: 1
55recvmsg: 1
56restart_syscall: 1
57rseq: 1
58rt_sigaction: 1
59rt_sigprocmask: 1
60rt_sigreturn: 1
61sched_getaffinity: 1
62sched_yield: 1
63sendmsg: 1
64sendto: 1
65set_robust_list: 1
66sigaltstack: 1
67tgkill: arg2 == SIGABRT
68write: 1
69writev: 1
70fcntl: 1
71uname: 1
72
73# ANDROID(b/271625758): disabled to fix duplicate syscall error.
74# ## Rules for vmm-swap
75# userfaultfd: 1
76# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
77# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
78
79statx: 1
80getdents64: 1
81name_to_handle_at: 1
82faccessat: 1
83faccessat2: 1
84newfstatat: 1
85timerfd_create: 1
86timerfd_settime: 1
87getsockname: 1
88openat: 1
89setsockopt: 1
90bind: 1
91socket: arg0 == AF_NETLINK
92# The following ioctls are:
93# 0x4008550d == USBDEVFS_REAPURBNDELAY
94# 0x550b == USBDEVFS_DISCARDURB
95# 0x8004550f == USBDEVFS_CLAIMINTERFACE
96# 0x80045510 == USBDEVFS_RELEASEINTERFACE
97# 0x80045515 == USBDEVFS_CLEAR_HALT
98# 0x8004551a == USBDEVFS_GET_CAPABILITIES
99# 0x8038550a == USBDEVFS_SUBMITURB
100# 0xc0185500 == USBDEVFS_CONTROL
101# 0x5514 == USBDEVFS_RESET
102# 0x80045505 == USBDEVFS_SETCONFIGURATION
103# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
104# 0x40085511 == USBDEVFS_CONNECTINFO
105# 0x80185520 == USBDEVFS_CONNINFO_EX
106# 0x551f == USBDEVFS_GET_SPEED
107# 0x8008551c == USBDEVFS_ALLOC_STREAMS
108# 0x8008551d == USBDEVFS_FREE_STREAMS
109# 0x80085504 == USBDEVFS_SETINTERFACE
110# 0x80044801 == HIDIOCGRDESCSIZE
111# 0x90044802 == HIDIOCGRDESC
112ioctl: arg1 == 0xc0185500 || arg1 == 0x8038550a || arg1 == 0x8004551a || arg1 == 0x4008550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520 || arg1 == 0x551f || arg1 == 0x8008551c || arg1 == 0x8008551d || arg1 == 0x80085504 || arg1 == 0x80044801 || arg1 == 0x90044802
113fstat: 1
114getrandom: 1
115prctl: arg0 == PR_SET_NAME
116