# This file is used to populate seccomp's allowlist policy in combination with SYSCALLS.TXT.
# Note that the resultant policy is applied only to zygote spawned processes.
#
# The final seccomp allowlist is SYSCALLS.TXT - SECCOMP_BLOCKLIST.TXT + SECCOMP_ALLOWLIST.TXT
# Any entry in the blocklist must be in the syscalls file and not be in the allowlist file
#
# This file is processed by a python script named genseccomp.py.

# Syscalls to modify IDs.
# Note: Some privileged syscalls are still needed in app_process after fork but
# before uid change, including capset and setresuid. This is because the seccomp
# filter must be installed while the process still has CAP_SYS_ADMIN; changing
# the uid would remove that capability.
int     setgid32(gid_t)     lp32
int     setgid(gid_t)       lp64
int     setuid32(uid_t)    lp32
int     setuid(uid_t)      lp64
int     setregid32(gid_t, gid_t)  lp32
int     setregid(gid_t, gid_t)    lp64
int     setreuid32(uid_t, uid_t)   lp32
int     setreuid(uid_t, uid_t)     lp64
int     setresgid32(gid_t, gid_t, gid_t)   lp32
int     setresgid(gid_t, gid_t, gid_t)     lp64
# setresuid is explicitly allowed, see above.
int     setfsgid32(gid_t) lp32
int     setfsgid(gid_t)   lp64
int     setfsuid32(uid_t) lp32
int     setfsuid(uid_t)   lp64
int     setgroups32(int, const gid_t*)   lp32
int     setgroups(int, const gid_t*)     lp64

# Syscalls to modify times.
int     adjtimex(struct timex*)   all
int     clock_adjtime(clockid_t, struct timex*)   all
int     clock_settime(clockid_t, const struct timespec*)  all
int     settimeofday(const struct timeval*, const struct timezone*)   all

int     acct(const char*  filepath)  all
int     syslog(int, char*, int)   all
int     chroot(const char*)  all

int     init_module(void*, unsigned long, const char*)  all
int     delete_module(const char*, unsigned int)   all
int     mount(const char*, const char*, const char*, unsigned long, const void*)  all
int     umount2(const char*, int)  all
int     swapon(const char*, int) all
int     swapoff(const char*) all
int     setdomainname(const char*, size_t)  all
int     sethostname(const char*, size_t)  all
int     reboot(int, int, int, void*)  all