1 # Minijail Seccomp Policy for isolated_app processes. 2 # This architecture-agnostic policy is appended to every architecture-specific 3 # policy. 4 5 brk: 1 6 capget: 1 7 capset: return EPERM 8 chdir: return EPERM 9 10 # clock_gettime: clk_id=={CLOCK_BOOTTIME,CLOCK_MONOTONIC,CLOCK_MONOTONIC_COARSE,CLOCK_THREAD_CPUTIME_ID,CLOCK_PROCESS_CPUTIME_ID,CLOCK_REALTIME,CLOCK_REALTIME_COARSE} || (clk_id < 0) 11 # clock_gettime accepts negative clk_id to access clock_posix_dynamic and clock_posix_cpu. 12 # This policy assumes clk_id is at least 32-bit wide, where the MSB means it is negative. 13 clock_gettime: arg0 == 0 || arg0 == 1 || arg0 == 2 || arg0 == 3 || arg0 == 5 || arg0 == 6 || arg0 == 7 || arg0 & 0x80000000 14 15 clone: 1 16 close: 1 17 dup: 1 18 dup3: 1 19 epoll_create1: 1 20 epoll_ctl: 1 21 epoll_pwait: 1 22 execve: return EPERM 23 exit: 1 24 exit_group: 1 25 faccessat: return EPERM 26 fallocate: return EPERM 27 fchdir: return EPERM 28 fchmodat: return EPERM 29 fchmod: return EPERM 30 fchownat: return EPERM 31 fchown: return EPERM 32 33 # fnctl: restrict cmd 34 # F_DUPFD_CLOEXEC=1030 35 fcntl: arg1 == F_GETFL || arg1 == F_GETFD || arg1 == F_SETFD || arg1 == F_SETLK || arg1 == F_SETLKW || arg1 == F_GETLK || arg1 == F_DUPFD || arg1 == 1030 36 37 fdatasync: 1 38 flock: 1 39 fstat: 1 40 fsync: 1 41 ftruncate: 1 42 43 # futex: TODO(rsesek): Restrict op (arg1) to {FUTEX_WAIT,FUTEX_WAKE,FUTEX_REQUEUE,FUTEX_CMP_REQUEUE, 44 # FUTEX_WAKE_OP,FUTEX_WAIT_BITSET,FUTEX_WAKE_BITSET} with only these flags allowed: 45 # (FUTEX_PRIVATE_FLAG | FUTEX_CLOCK_REALTIME). Unclear how to express this in minijail. 46 futex: 1 47 48 getcwd: return EPERM 49 getegid: 1 50 geteuid: 1 51 getgid: 1 52 getgroups: 1 53 getpid: 1 54 getppid: 1 55 getpriority: 1 56 57 # getrandom: flags==0 || flags & GRND_NONBLOCK 58 getrandom: arg2 == 0 || arg2 & 1 59 60 getresgid: 1 61 getresuid: 1 62 getsid: 1 63 gettid: 1 64 gettimeofday: 1 65 getuid: 1 66 ioctl: 1 67 68 # kill: pid==getpid() 69 kill: arg0 == $ 70 71 linkat: return EPERM 72 lookup_dcookie: return EPERM 73 lseek: 1 74 75 # madvise: advice==MADV_DONTNEED 76 madvise: arg2 == 4; return EPERM 77 78 membarrier: 1 79 memfd_create: return EPERM 80 mkdirat: return EPERM 81 mknodat: return EPERM 82 mlock: 1 83 84 # mprotect: prot in {PROT_READ|PROT_WRITE|PROT_EXEC} 85 mprotect: arg2 in 0x7 86 87 mremap: 1 88 msync: 1 89 munlock: 1 90 munmap: 1 91 nanosleep: 1 92 openat: 1 93 pipe2: 1 94 ppoll: 1 95 96 # prctl: PR_SET_VMA=0x53564d41, PR_SET_TIMERSLACK_PID={41,43,127} depending on kernel version 97 prctl: arg0 == PR_GET_NAME || arg0 == PR_SET_NAME || arg0 == PR_GET_DUMPABLE || arg0 == PR_SET_DUMPABLE || arg0 == PR_SET_PTRACER || arg0 == PR_SET_TIMERSLACK || arg0 == 0x53564d41 || arg0 == 41 || arg0 == 43 || arg0 == 127 98 99 pread64: 1 100 pselect6: 1 101 ptrace: 1 102 pwrite64: 1 103 read: 1 104 readlinkat: return EPERM 105 readv: 1 106 renameat: return EPERM 107 renameat2: return EPERM 108 restart_syscall: 1 109 rt_sigaction: 1 110 rt_sigprocmask: 1 111 rt_sigreturn: 1 112 rt_sigtimedwait: 1 113 114 # rt_tgsigqueueinfo: tgid==getpid() 115 rt_tgsigqueueinfo: arg0 == $ 116 117 sched_getparam: 1 118 sched_getscheduler: 1 119 sched_setscheduler: 1 120 sched_yield: 1 121 seccomp: return EPERM 122 setfsgid: return EPERM 123 setfsuid: return EPERM 124 setgid: return EPERM 125 setgroups: return EPERM 126 setpriority: 1 127 setregid: return EPERM 128 setresgid: return EPERM 129 setresuid: return EPERM 130 setreuid: return EPERM 131 set_robust_list: return EPERM 132 set_tid_address: 1 133 setuid: return EPERM 134 sigaltstack: 1 135 statfs: return EPERM 136 symlinkat: return EPERM 137 138 # tgkill: tgid==getpid() 139 tgkill: arg0 == $ 140 141 truncate: return EPERM 142 umask: return EPERM 143 uname: 1 144 unlinkat: return EPERM 145 utimensat: return EPERM 146 wait4: 1 147 waitid: 1 148 write: 1 149 writev: 1 150
