444 lines
7.2 KiB
Text
444 lines
7.2 KiB
Text
/* This sample file is an example for mkseccomp.pl to produce a seccomp file
|
|
* which restricts syscalls that are only useful for an admin but allows the
|
|
* vast majority of normal userspace programs to run normally.
|
|
*
|
|
* The format of this file is one line per syscall. This is then processed
|
|
* and passed to 'cpp' to convert the names to numbers using whatever is
|
|
* correct for your platform. As such C-style comments are permitted. Note
|
|
* this also means that C preprocessor macros are also allowed. So it is
|
|
* possible to create groups surrounded by #ifdef/#endif and control their
|
|
* inclusion via #define (not #include).
|
|
*
|
|
* Syscalls that don't exist on your architecture are silently filtered out.
|
|
* Syscalls marked with (*) are required for a container to spawn a bash
|
|
* shell successfully (not necessarily full featured). Listing the same
|
|
* syscall multiple times is no problem.
|
|
*
|
|
* If you want to make a list specifically for one application the easiest
|
|
* way is to run the application under strace, like so:
|
|
*
|
|
* $ strace -f -q -c -o strace.out application args...
|
|
*
|
|
* Once you have a reasonable sample of the execution of the program, exit
|
|
* it. The file strace.out will have a summary of the syscalls used. Copy
|
|
* that list into this file, comment out everything else except the starred
|
|
* syscalls (which you need for the container to start) and you're done.
|
|
*
|
|
* To get the list of syscalls from the strace output this works well for
|
|
* me
|
|
*
|
|
* $ cut -c52 < strace.out
|
|
*
|
|
* This sample list was compiled as a combination of all the syscalls
|
|
* available on i386 and amd64 on Ubuntu Precise, as such it may not contain
|
|
* everything and not everything may be relevant for your system. This
|
|
* shouldn't be a problem.
|
|
*/
|
|
|
|
// Filesystem/File descriptor related
|
|
access // (*)
|
|
chdir // (*)
|
|
chmod
|
|
chown
|
|
chown32
|
|
close // (*)
|
|
creat
|
|
dup // (*)
|
|
dup2 // (*)
|
|
dup3
|
|
epoll_create
|
|
epoll_create1
|
|
epoll_ctl
|
|
epoll_ctl_old
|
|
epoll_pwait
|
|
epoll_wait
|
|
epoll_wait_old
|
|
eventfd
|
|
eventfd2
|
|
faccessat // (*)
|
|
fadvise64
|
|
fadvise64_64
|
|
fallocate
|
|
fanotify_init
|
|
fanotify_mark
|
|
ioctl // (*)
|
|
fchdir
|
|
fchmod
|
|
fchmodat
|
|
fchown
|
|
fchown32
|
|
fchownat
|
|
fcntl // (*)
|
|
fcntl64
|
|
fdatasync
|
|
fgetxattr
|
|
flistxattr
|
|
flock
|
|
fremovexattr
|
|
fsetxattr
|
|
fstat // (*)
|
|
fstat64
|
|
fstatat64
|
|
fstatfs
|
|
fstatfs64
|
|
fsync
|
|
ftruncate
|
|
ftruncate64
|
|
getcwd // (*)
|
|
getdents // (*)
|
|
getdents64
|
|
getxattr
|
|
inotify_add_watch
|
|
inotify_init
|
|
inotify_init1
|
|
inotify_rm_watch
|
|
io_cancel
|
|
io_destroy
|
|
io_getevents
|
|
io_setup
|
|
io_submit
|
|
lchown
|
|
lchown32
|
|
lgetxattr
|
|
link
|
|
linkat
|
|
listxattr
|
|
llistxattr
|
|
llseek
|
|
_llseek
|
|
lremovexattr
|
|
lseek // (*)
|
|
lsetxattr
|
|
lstat
|
|
lstat64
|
|
mkdir
|
|
mkdirat
|
|
mknod
|
|
mknodat
|
|
newfstatat
|
|
_newselect
|
|
oldfstat
|
|
oldlstat
|
|
oldolduname
|
|
oldstat
|
|
olduname
|
|
oldwait4
|
|
open // (*)
|
|
openat // (*)
|
|
pipe // (*)
|
|
pipe2
|
|
poll
|
|
ppoll
|
|
pread64
|
|
preadv
|
|
futimesat
|
|
pselect6
|
|
pwrite64
|
|
pwritev
|
|
read // (*)
|
|
readahead
|
|
readdir
|
|
readlink
|
|
readlinkat
|
|
readv
|
|
removexattr
|
|
rename
|
|
renameat
|
|
rmdir
|
|
select
|
|
sendfile
|
|
sendfile64
|
|
setxattr
|
|
splice
|
|
stat // (*)
|
|
stat64
|
|
statfs // (*)
|
|
statfs64
|
|
symlink
|
|
symlinkat
|
|
sync
|
|
sync_file_range
|
|
sync_file_range2
|
|
syncfs
|
|
tee
|
|
truncate
|
|
truncate64
|
|
umask
|
|
unlink
|
|
unlinkat
|
|
ustat
|
|
utime
|
|
utimensat
|
|
utimes
|
|
write // (*)
|
|
writev
|
|
|
|
// Network related
|
|
accept
|
|
accept4
|
|
bind // (*)
|
|
connect // (*)
|
|
getpeername
|
|
getsockname // (*)
|
|
getsockopt
|
|
listen
|
|
recv
|
|
recvfrom // (*)
|
|
recvmmsg
|
|
recvmsg
|
|
send
|
|
sendmmsg
|
|
sendmsg
|
|
sendto // (*)
|
|
setsockopt
|
|
shutdown
|
|
socket // (*)
|
|
socketcall
|
|
socketpair
|
|
sethostname // (*)
|
|
|
|
// Signal related
|
|
pause
|
|
rt_sigaction // (*)
|
|
rt_sigpending
|
|
rt_sigprocmask // (*)
|
|
rt_sigqueueinfo
|
|
rt_sigreturn // (*)
|
|
rt_sigsuspend
|
|
rt_sigtimedwait
|
|
rt_tgsigqueueinfo
|
|
sigaction
|
|
sigaltstack // (*)
|
|
signal
|
|
signalfd
|
|
signalfd4
|
|
sigpending
|
|
sigprocmask
|
|
sigreturn
|
|
sigsuspend
|
|
|
|
// Other needed POSIX
|
|
alarm
|
|
brk // (*)
|
|
clock_adjtime
|
|
clock_getres
|
|
clock_gettime
|
|
clock_nanosleep
|
|
//clock_settime
|
|
gettimeofday
|
|
nanosleep
|
|
nice
|
|
sysinfo
|
|
syslog
|
|
time
|
|
timer_create
|
|
timer_delete
|
|
timerfd_create
|
|
timerfd_gettime
|
|
timerfd_settime
|
|
timer_getoverrun
|
|
timer_gettime
|
|
timer_settime
|
|
times
|
|
uname // (*)
|
|
|
|
// Memory control
|
|
madvise
|
|
mbind
|
|
mincore
|
|
mlock
|
|
mlockall
|
|
mmap // (*)
|
|
mmap2
|
|
mprotect // (*)
|
|
mremap
|
|
msync
|
|
munlock
|
|
munlockall
|
|
munmap // (*)
|
|
remap_file_pages
|
|
set_mempolicy
|
|
vmsplice
|
|
|
|
// Process control
|
|
capget
|
|
capset // (*)
|
|
clone // (*)
|
|
execve // (*)
|
|
exit // (*)
|
|
exit_group // (*)
|
|
fork
|
|
getcpu
|
|
getpgid
|
|
getpgrp // (*)
|
|
getpid // (*)
|
|
getppid // (*)
|
|
getpriority
|
|
getresgid
|
|
getresgid32
|
|
getresuid
|
|
getresuid32
|
|
getrlimit // (*)
|
|
getrusage
|
|
getsid
|
|
getuid // (*)
|
|
getuid32
|
|
getegid // (*)
|
|
getegid32
|
|
geteuid // (*)
|
|
geteuid32
|
|
getgid // (*)
|
|
getgid32
|
|
getgroups
|
|
getgroups32
|
|
getitimer
|
|
get_mempolicy
|
|
kill
|
|
//personality
|
|
prctl
|
|
prlimit64
|
|
sched_getaffinity
|
|
sched_getparam
|
|
sched_get_priority_max
|
|
sched_get_priority_min
|
|
sched_getscheduler
|
|
sched_rr_get_interval
|
|
//sched_setaffinity
|
|
//sched_setparam
|
|
//sched_setscheduler
|
|
sched_yield
|
|
setfsgid
|
|
setfsgid32
|
|
setfsuid
|
|
setfsuid32
|
|
setgid
|
|
setgid32
|
|
setgroups
|
|
setgroups32
|
|
setitimer
|
|
setpgid // (*)
|
|
setpriority
|
|
setregid
|
|
setregid32
|
|
setresgid
|
|
setresgid32
|
|
setresuid
|
|
setresuid32
|
|
setreuid
|
|
setreuid32
|
|
setrlimit
|
|
setsid
|
|
setuid
|
|
setuid32
|
|
ugetrlimit
|
|
vfork
|
|
wait4 // (*)
|
|
waitid
|
|
waitpid
|
|
|
|
// IPC
|
|
ipc
|
|
mq_getsetattr
|
|
mq_notify
|
|
mq_open
|
|
mq_timedreceive
|
|
mq_timedsend
|
|
mq_unlink
|
|
msgctl
|
|
msgget
|
|
msgrcv
|
|
msgsnd
|
|
semctl
|
|
semget
|
|
semop
|
|
semtimedop
|
|
shmat
|
|
shmctl
|
|
shmdt
|
|
shmget
|
|
|
|
// Linux specific, mostly needed for thread-related stuff
|
|
arch_prctl // (*)
|
|
get_robust_list
|
|
get_thread_area
|
|
gettid
|
|
futex // (*)
|
|
restart_syscall // (*)
|
|
set_robust_list // (*)
|
|
set_thread_area
|
|
set_tid_address // (*)
|
|
tgkill
|
|
tkill
|
|
|
|
// Admin syscalls, these are blocked
|
|
//acct
|
|
//adjtimex
|
|
//bdflush
|
|
//chroot
|
|
//create_module
|
|
//delete_module
|
|
//get_kernel_syms // Obsolete
|
|
//idle // Obsolete
|
|
//init_module
|
|
//ioperm
|
|
//iopl
|
|
//ioprio_get
|
|
//ioprio_set
|
|
//kexec_load
|
|
//lookup_dcookie // oprofile only?
|
|
//migrate_pages // NUMA
|
|
//modify_ldt
|
|
//mount
|
|
//move_pages // NUMA
|
|
//name_to_handle_at // NFS server
|
|
//nfsservctl // NFS server
|
|
//open_by_handle_at // NFS server
|
|
//perf_event_open
|
|
//pivot_root
|
|
//process_vm_readv // For debugger
|
|
//process_vm_writev // For debugger
|
|
//ptrace // For debugger
|
|
//query_module
|
|
//quotactl
|
|
//reboot
|
|
//setdomainname
|
|
//setns
|
|
//settimeofday
|
|
//sgetmask // Obsolete
|
|
//ssetmask // Obsolete
|
|
//stime
|
|
//swapoff
|
|
//swapon
|
|
//_sysctl
|
|
//sysfs
|
|
//sys_setaltroot
|
|
//umount
|
|
//umount2
|
|
//unshare
|
|
//uselib
|
|
//vhangup
|
|
//vm86
|
|
//vm86old
|
|
|
|
// Kernel key management
|
|
//add_key
|
|
//keyctl
|
|
//request_key
|
|
|
|
// Unimplemented
|
|
//afs_syscall
|
|
//break
|
|
//ftime
|
|
//getpmsg
|
|
//gtty
|
|
//lock
|
|
//madvise1
|
|
//mpx
|
|
//prof
|
|
//profil
|
|
//putpmsg
|
|
//security
|
|
//stty
|
|
//tuxcall
|
|
//ulimit
|
|
//vserver
|