1# Copyright (c) 2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14# For now, it supports architechture of ['arm', 'arm64', 'riscv64']. 15 16@returnValue 17TRAP 18 19@headFiles 20<linux/sched.h> 21<stdint.h> 22 23@priority 24futex;all 25 26@allowList 27io_setup;all 28io_destroy;all 29io_submit;all 30io_cancel;all 31io_getevents;all 32setxattr;all 33lsetxattr;all 34fsetxattr;all 35getxattr;all 36lgetxattr;all 37fgetxattr;all 38listxattr;all 39llistxattr;all 40flistxattr;all 41removexattr;all 42lremovexattr;all 43fremovexattr;all 44getcwd;all 45eventfd2;all 46epoll_create1;all 47epoll_ctl;all 48epoll_pwait;all 49dup;all 50dup3;all 51fcntl;all 52inotify_init1;all 53inotify_add_watch;all 54inotify_rm_watch;all 55ioprio_set;arm64 56ioprio_set;riscv64 57ioprio_get;arm64 58ioprio_get;riscv64 59flock;all 60mknodat;all 61mkdirat;all 62unlinkat;all 63symlinkat;all 64linkat;all 65renameat;arm 66renameat;arm64 67pivot_root;riscv64 68statfs;arm64 69statfs;riscv64 70fstatfs;arm64 71fstatfs;riscv64 72truncate;all 73ftruncate;arm64 74ftruncate;riscv64 75fallocate;all 76faccessat;all 77chdir;all 78fchdir;all 79fchmod;all 80fchmodat;all 81fchownat;all 82fchown;arm64 83fchown;riscv64 84openat;all 85close;all 86pipe2;all 87quotactl;all 88getdents64;all 89lseek;all 90read;all 91write;all 92readv;all 93writev;all 94pread64;all 95pwrite64;all 96preadv;all 97pwritev;all 98sendfile;all 99pselect6;all 100ppoll;all 101signalfd4;all 102vmsplice;all 103splice;all 104tee;all 105readlinkat;all 106newfstatat;arm64 107newfstatat;riscv64 108fstat;arm64 109fstat;riscv64 110sync;all 111fsync;all 112fdatasync;all 113sync_file_range;arm64 114sync_file_range;riscv64 115timerfd_create;all 116timerfd_settime;all 117timerfd_gettime;all 118utimensat;all 119capget;all 120capset;all 121personality;all 122exit;all 123exit_group;all 124waitid;all 125set_tid_address;all 126futex;all 127nanosleep;all 128getitimer;all 129setitimer;all 130timer_create;all 131timer_gettime;all 132timer_getoverrun;all 133timer_settime;all 134timer_delete;all 135clock_gettime;all 136clock_getres;all 137clock_nanosleep;all 138ptrace;all 139sched_setparam;all 140sched_setscheduler;all 141sched_getscheduler;all 142sched_getparam;all 143sched_setaffinity;all 144sched_getaffinity;all 145sched_yield;all 146sched_get_priority_max;all 147sched_get_priority_min;all 148sched_rr_get_interval;all 149restart_syscall;all 150kill;all 151tkill;all 152tgkill;all 153sigaltstack;all 154rt_sigsuspend;all 155rt_sigaction;all 156rt_sigprocmask;all 157rt_sigpending;all 158rt_sigtimedwait;all 159rt_sigqueueinfo;all 160rt_sigreturn;all 161setpriority;all 162getpriority;all 163setresuid;arm64 164setresuid;riscv64 165getresuid;arm64 166getresuid;riscv64 167getresgid;arm64 168getresgid;riscv64 169times;all 170setpgid;all 171getpgid;all 172getsid;all 173setsid;all 174getgroups;arm64 175getgroups;riscv64 176uname;all 177getrlimit;arm64 178getrlimit;riscv64 179setrlimit;all 180getrusage;all 181umask;all 182prctl;all 183getcpu;all 184gettimeofday;all 185getpid;all 186getppid;all 187getuid;all 188geteuid;arm64 189geteuid;riscv64 190getgid;arm64 191getgid;riscv64 192getegid;arm64 193getegid;riscv64 194gettid;all 195sysinfo;all 196socket;all 197socketpair;all 198bind;all 199listen;all 200accept;all 201connect;all 202getsockname;all 203getpeername;all 204sendto;all 205recvfrom;all 206setsockopt;all 207getsockopt;all 208shutdown;all 209sendmsg;all 210recvmsg;all 211readahead;all 212brk;all 213munmap;all 214mremap;all 215execve;all 216mmap;arm64 217mmap;riscv64 218fadvise64;arm64 219fadvise64;riscv64 220mprotect;all 221msync;all 222mlock;all 223munlock;all 224mlockall;all 225munlockall;all 226mincore;all 227madvise;all 228rt_tgsigqueueinfo;all 229perf_event_open;all 230accept4;all 231recvmmsg;all 232wait4;all 233prlimit64;all 234syncfs;all 235sendmmsg;all 236process_vm_readv;all 237process_vm_writev;all 238sched_setattr;all 239sched_getattr;all 240renameat2;all 241seccomp;all 242getrandom;all 243memfd_create;all 244execveat;all 245userfaultfd;all 246membarrier;all 247mlock2;all 248copy_file_range;all 249preadv2;all 250pwritev2;all 251statx;all 252pidfd_send_signal;all 253pidfd_open;all 254pidfd_getfd;all 255faccessat2;all 256process_madvise;all 257set_robust_list;all 258fork;arm 259open;arm 260creat;arm 261link;arm 262unlink;arm 263chmod;arm 264access;arm 265rename;arm 266mkdir;arm 267rmdir;arm 268pipe;arm 269dup2;arm 270sigaction;arm 271symlink;arm 272readlink;arm 273sigreturn;arm 274_llseek;arm 275getdents;arm 276_newselect;arm 277poll;arm 278vfork;arm 279ugetrlimit;arm 280mmap2;arm 281truncate64;arm 282ftruncate64;arm 283stat64;arm 284lstat64;arm 285fstat64;arm 286lchown32;arm 287getuid32;arm 288getgid32;arm 289geteuid32;arm 290getegid32;arm 291getgroups32;arm 292fchown32;arm 293setresuid32;arm 294getresuid32;arm 295getresgid32;arm 296chown32;arm 297fcntl64;arm 298sendfile64;arm 299epoll_create;arm 300epoll_wait;arm 301remap_file_pages;arm 302statfs64;arm 303fstatfs64;arm 304fadvise64_64;arm 305inotify_init;arm 306fstatat64;arm 307sync_file_range2;arm 308eventfd;arm 309clock_gettime64;arm 310clock_settime64;arm 311clock_adjtime64;arm 312clock_getres_time64;arm 313clock_nanosleep_time64;arm 314timer_gettime64;arm 315timer_settime64;arm 316timerfd_gettime64;arm 317timerfd_settime64;arm 318utimensat_time64;arm 319pselect6_time64;arm 320ppoll_time64;arm 321recvmmsg_time64;arm 322semtimedop_time64;arm 323rt_sigtimedwait_time64;arm 324futex_time64;arm 325sched_rr_get_interval_time64;arm 326cacheflush;arm 327set_tls;arm 328 329@allowListWithArgs 330clone: if (arg0 & (CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWNET | CLONE_NEWCGROUP | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER)) == 0 ; return ALLOW; else return TRAP;all 331ioctl: if arg1 >= 0x5000 && arg1 <= 0x5005; return TRAP; elif arg1 >= 0x5007 && arg1 <= 0x500d; return TRAP; elif arg1 >= 0x5100 && arg1 <= 0x5103; return TRAP; elif arg1 >= 0x5105 && arg1 <= 0x5106; return TRAP; elif arg1 == 0x510a; return TRAP; elif arg1 >= 0x5300 && arg1 <= 0x530f; return TRAP; elif arg1 >= 0x5400 && arg1 <= 0x5409; return TRAP; elif arg1 >= 0x5482 && arg1 <= 0x5490; return TRAP; else return ALLOW;all 332