1# Copyright 2019 The ChromiumOS Authors
2# Use of this source code is governed by a BSD-style license that can be
3# found in the LICENSE file.
4
5# Copyright 2019 The ChromiumOS Authors
6# Use of this source code is governed by a BSD-style license that can be
7# found in the LICENSE file.
8
9# This is an allow list of syscalls for most of crosvm devices.
10#
11# Note that some device policy files don't depend on this policy file
12# because of some conflicts such as gpu_common.policy.
13# If you want to modify policies for all the devices, please modify
14# not only this file but also other *_common.policy files.
15
16brk: 1
17clock_gettime: 1
18clone: arg0 & CLONE_THREAD
19clone3: 1
20close: 1
21dup3: 1
22dup: 1
23epoll_create1: 1
24epoll_ctl: 1
25epoll_pwait: 1
26eventfd2: 1
27exit: 1
28exit_group: 1
29ftruncate: 1
30futex: 1
31getcwd: 1
32getpid: 1
33gettid: 1
34gettimeofday: 1
35io_uring_setup: 1
36io_uring_register: 1
37io_uring_enter: 1
38kill: 1
39lseek: 1
40madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
41membarrier: 1
42memfd_create: 1
43mmap: arg2 in ~PROT_EXEC
44mprotect: arg2 in ~PROT_EXEC
45mremap: 1
46munmap: 1
47nanosleep: 1
48clock_nanosleep: 1
49pipe2: 1
50ppoll: 1
51read: 1
52readlinkat: 1
53readv: 1
54recvfrom: 1
55recvmsg: 1
56restart_syscall: 1
57rseq: 1
58rt_sigaction: 1
59rt_sigprocmask: 1
60rt_sigreturn: 1
61sched_getaffinity: 1
62sched_yield: 1
63sendmsg: 1
64sendto: 1
65set_robust_list: 1
66sigaltstack: 1
67tgkill: arg2 == SIGABRT
68write: 1
69writev: 1
70fcntl: 1
71uname: 1
72
73# ANDROID(b/271625758): disabled to fix duplicate syscall error.
74# ## Rules for vmm-swap
75# userfaultfd: 1
76# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
77# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00
78
79getrandom: 1
80openat: return ENOENT
81prctl: arg0 == PR_SET_NAME
82