1# Seccomp 2 3The seccomp system is used to filter the syscalls that sandboxed processes can use. The form of 4seccomp used by crosvm (`SECCOMP_SET_MODE_FILTER`) allows for a BPF program to be used. To generate 5the BPF programs, crosvm uses minijail's policy file format. A policy file is written for each 6device per architecture. Each device requires a unique set of syscalls to accomplish their function 7and each architecture has slightly different naming for similar syscalls. The ChromeOS docs have a 8useful 9[listing of syscalls](https://www.chromium.org/chromium-os/developer-library/reference/linux-constants/syscalls/). 10 11The seccomp policies are compiled from `.policy` source files into BPF bytecode by 12[`jail/build.rs`](https://chromium.googlesource.com/crosvm/crosvm/+/refs/heads/main/jail/build.rs) 13and embedded in the crosvm executable, so it is not necessary to install the seccomp policy files, 14only the crosvm binary itself. Be sure to remember to rebuild crosvm after changing a policy file to 15observe the updated behavior. 16 17## Writing a Policy for crosvm 18 19The detailed rules for naming policy files can be found in 20[jail/seccomp/README.md](https://chromium.googlesource.com/crosvm/crosvm/+/refs/heads/main/jail/seccomp/README.md) 21 22Most policy files will include the `common_device.policy` from a given architecture using this 23directive near the top: 24 25``` 26@include /usr/share/policy/crosvm/common_device.policy 27``` 28 29The common device policy for `x86_64` is: 30 31``` 32{{#include ../../../../jail/seccomp/x86_64/common_device.policy:5:}} 33``` 34 35The syntax is simple: one syscall per line, followed by a colon `:`, followed by a boolean 36expression used to constrain the arguments of the syscall. The simplest expression is `1` which 37unconditionally allows the syscall. Only simple expressions work, often to allow or deny specific 38flags. A major limitation is that checking the contents of pointers isn't possible using minijail's 39policy format. If a syscall is not listed in a policy file, it is not allowed. 40