1# Copyright 2019 The ChromiumOS Authors 2# Use of this source code is governed by a BSD-style license that can be 3# found in the LICENSE file. 4 5# This is an allow list of syscalls for most of crosvm devices. 6# 7# Note that some device policy files don't depend on this policy file 8# because of some conflicts such as gpu_common.policy. 9# If you want to modify policies for all the devices, please modify 10# not only this file but also other *_common.policy files. 11 12brk: 1 13clock_gettime: 1 14clone: arg0 & CLONE_THREAD 15clone3: 1 16close: 1 17dup3: 1 18dup: 1 19epoll_create1: 1 20epoll_ctl: 1 21epoll_pwait: 1 22eventfd2: 1 23exit: 1 24exit_group: 1 25ftruncate: 1 26futex: 1 27getcwd: 1 28getpid: 1 29gettid: 1 30gettimeofday: 1 31io_uring_setup: 1 32io_uring_register: 1 33io_uring_enter: 1 34kill: 1 35lseek: 1 36madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE 37membarrier: 1 38memfd_create: 1 39mmap: arg2 in ~PROT_EXEC 40mprotect: arg2 in ~PROT_EXEC 41mremap: 1 42munmap: 1 43nanosleep: 1 44clock_nanosleep: 1 45pipe2: 1 46ppoll: 1 47read: 1 48readlinkat: 1 49readv: 1 50recvfrom: 1 51recvmsg: 1 52restart_syscall: 1 53rseq: 1 54rt_sigaction: 1 55rt_sigprocmask: 1 56rt_sigreturn: 1 57sched_getaffinity: 1 58sched_yield: 1 59sendmsg: 1 60sendto: 1 61set_robust_list: 1 62sigaltstack: 1 63tgkill: arg2 == SIGABRT 64write: 1 65writev: 1 66fcntl: 1 67uname: 1 68 69# ANDROID(b/271625758): disabled to fix duplicate syscall error. 70# ## Rules for vmm-swap 71# userfaultfd: 1 72# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW 73# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00 74