1# Copyright (c) 2025 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14# For now, it supports architechture of ['arm', 'arm64', 'riscv64']. 15 16@returnValue 17TRAP 18 19@headFiles 20<linux/sched.h> 21<stdint.h> 22 23@priority 24ioctl;all 25futex;all 26 27@allowList 28io_uring_setup;all 29io_uring_enter;all 30io_uring_register;all 31io_setup;all 32io_destroy;all 33io_submit;all 34io_cancel;all 35io_getevents;all 36setxattr;all 37lsetxattr;all 38fsetxattr;all 39getxattr;all 40lgetxattr;all 41fgetxattr;all 42listxattr;all 43llistxattr;all 44flistxattr;all 45removexattr;all 46lremovexattr;all 47fremovexattr;all 48getcwd;all 49eventfd2;all 50epoll_create1;all 51epoll_ctl;all 52epoll_pwait;all 53dup;all 54dup3;all 55fcntl;all 56inotify_init1;all 57inotify_add_watch;all 58inotify_rm_watch;all 59ioctl;all 60ioprio_set;arm64 61ioprio_set;riscv64 62ioprio_get;arm64 63ioprio_get;riscv64 64flock;all 65mknodat;all 66mkdirat;all 67unlinkat;all 68symlinkat;all 69linkat;all 70renameat;arm 71renameat;arm64 72pivot_root;riscv64 73statfs;arm64 74statfs;riscv64 75fstatfs;arm64 76fstatfs;riscv64 77truncate;all 78ftruncate;arm64 79ftruncate;riscv64 80fallocate;all 81faccessat;all 82chdir;all 83fchdir;all 84fchmod;all 85fchmodat;all 86fchownat;all 87fchown;arm64 88fchown;riscv64 89openat;all 90close;all 91pipe2;all 92quotactl;all 93getdents64;all 94lseek;all 95read;all 96write;all 97readv;all 98writev;all 99pread64;all 100pwrite64;all 101preadv;all 102pwritev;all 103sendfile;all 104pselect6;all 105ppoll;all 106signalfd4;all 107vmsplice;all 108splice;all 109tee;all 110readlinkat;all 111newfstatat;arm64 112newfstatat;riscv64 113fstat;arm64 114fstat;riscv64 115sync;all 116fsync;all 117fdatasync;all 118sync_file_range;arm64 119sync_file_range;riscv64 120timerfd_create;all 121timerfd_settime;all 122timerfd_gettime;all 123utimensat;all 124capget;all 125capset;all 126personality;all 127exit;all 128exit_group;all 129waitid;all 130set_tid_address;all 131futex;all 132nanosleep;all 133getitimer;all 134setitimer;all 135timer_create;all 136timer_gettime;all 137timer_getoverrun;all 138timer_settime;all 139timer_delete;all 140clock_gettime;all 141clock_getres;all 142clock_nanosleep;all 143ptrace;all 144sched_setparam;all 145sched_setscheduler;all 146sched_getscheduler;all 147sched_getparam;all 148sched_setaffinity;all 149sched_getaffinity;all 150sched_yield;all 151sched_get_priority_max;all 152sched_get_priority_min;all 153sched_rr_get_interval;all 154restart_syscall;all 155kill;all 156tkill;all 157tgkill;all 158sigaltstack;all 159rt_sigsuspend;all 160rt_sigaction;all 161rt_sigprocmask;all 162rt_sigpending;all 163rt_sigtimedwait;all 164rt_sigqueueinfo;all 165rt_sigreturn;all 166setpriority;all 167getpriority;all 168setresuid;arm64 169setresuid;riscv64 170getresuid;arm64 171getresuid;riscv64 172getresgid;arm64 173getresgid;riscv64 174times;all 175setpgid;all 176getpgid;all 177getsid;all 178setsid;all 179getgroups;arm64 180getgroups;riscv64 181uname;all 182getrlimit;arm64 183getrlimit;riscv64 184setrlimit;all 185getrusage;all 186umask;all 187prctl;all 188getcpu;all 189gettimeofday;all 190getpid;all 191getppid;all 192getuid;all 193geteuid;arm64 194geteuid;riscv64 195getgid;arm64 196getgid;riscv64 197getegid;arm64 198getegid;riscv64 199gettid;all 200sysinfo;all 201socket;all 202socketpair;all 203bind;all 204listen;all 205accept;all 206connect;all 207getsockname;all 208getpeername;all 209sendto;all 210recvfrom;all 211setsockopt;all 212getsockopt;all 213shutdown;all 214sendmsg;all 215recvmsg;all 216readahead;all 217brk;all 218munmap;all 219mremap;all 220execve;all 221mmap;arm64 222mmap;riscv64 223fadvise64;arm64 224fadvise64;riscv64 225mprotect;all 226msync;all 227mlock;all 228munlock;all 229mlockall;all 230munlockall;all 231mincore;all 232madvise;all 233rt_tgsigqueueinfo;all 234perf_event_open;all 235accept4;all 236recvmmsg;all 237wait4;all 238prlimit64;all 239syncfs;all 240sendmmsg;all 241process_vm_readv;all 242process_vm_writev;all 243sched_setattr;all 244sched_getattr;all 245renameat2;all 246seccomp;all 247getrandom;all 248memfd_create;all 249execveat;all 250userfaultfd;all 251membarrier;all 252mlock2;all 253copy_file_range;all 254preadv2;all 255pwritev2;all 256statx;all 257pidfd_send_signal;all 258pidfd_open;all 259pidfd_getfd;all 260faccessat2;all 261process_madvise;all 262set_robust_list;all 263fork;arm 264open;arm 265creat;arm 266link;arm 267unlink;arm 268chmod;arm 269access;arm 270rename;arm 271mkdir;arm 272rmdir;arm 273pipe;arm 274dup2;arm 275sigaction;arm 276symlink;arm 277readlink;arm 278sigreturn;arm 279_llseek;arm 280getdents;arm 281_newselect;arm 282poll;arm 283vfork;arm 284ugetrlimit;arm 285mmap2;arm 286truncate64;arm 287ftruncate64;arm 288stat64;arm 289lstat64;arm 290fstat64;arm 291lchown32;arm 292getuid32;arm 293getgid32;arm 294geteuid32;arm 295getegid32;arm 296getgroups32;arm 297fchown32;arm 298setresuid32;arm 299getresuid32;arm 300getresgid32;arm 301chown32;arm 302fcntl64;arm 303sendfile64;arm 304epoll_create;arm 305epoll_wait;arm 306remap_file_pages;arm 307statfs64;arm 308fstatfs64;arm 309fadvise64_64;arm 310inotify_init;arm 311fstatat64;arm 312sync_file_range2;arm 313eventfd;arm 314clock_gettime64;arm 315clock_settime64;arm 316clock_adjtime64;arm 317clock_getres_time64;arm 318clock_nanosleep_time64;arm 319timer_gettime64;arm 320timer_settime64;arm 321timerfd_gettime64;arm 322timerfd_settime64;arm 323utimensat_time64;arm 324pselect6_time64;arm 325ppoll_time64;arm 326recvmmsg_time64;arm 327semtimedop_time64;arm 328rt_sigtimedwait_time64;arm 329futex_time64;arm 330sched_rr_get_interval_time64;arm 331cacheflush;arm 332set_tls;arm 333 334@allowListWithArgs 335clone: if (arg0 & (CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWNET | CLONE_NEWCGROUP | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER)) == 0 ; return ALLOW; else return TRAP;all 336