1 # Copyright (C) 2019 The Android Open Source Project 2 # 3 # Licensed under the Apache License, Version 2.0 (the "License"); 4 # you may not use this file except in compliance with the License. 5 # You may obtain a copy of the License at 6 # 7 # http://www.apache.org/licenses/LICENSE-2.0 8 # 9 # Unless required by applicable law or agreed to in writing, software 10 # distributed under the License is distributed on an "AS IS" BASIS, 11 # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 12 # See the License for the specific language governing permissions and 13 # limitations under the License. 14 15 futex: 1 16 # ioctl calls are filtered via the selinux policy. 17 ioctl: 1 18 sched_yield: 1 19 close: 1 20 dup: 1 21 ppoll: 1 22 mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE 23 mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE 24 getuid: 1 25 getrlimit: 1 26 fstat: 1 27 newfstatat: 1 28 fstatfs: 1 29 memfd_create: 1 30 ftruncate: 1 31 32 # mremap: Ensure |flags| are (MREMAP_MAYMOVE | MREMAP_FIXED) TODO: Once minijail 33 # parser support for '<' is in this needs to be modified to also prevent 34 # |old_address| and |new_address| from touching the exception vector page, which 35 # on ARM is statically loaded at 0xffff 0000. See 36 # http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0211h/Babfeega.html 37 # for more details. 38 mremap: arg3 == 3 39 munmap: 1 40 prctl: 1 41 writev: 1 42 sigaltstack: 1 43 clone: 1 44 exit: 1 45 lseek: 1 46 rt_sigprocmask: 1 47 openat: 1 48 write: 1 49 nanosleep: 1 50 setpriority: 1 51 set_tid_address: 1 52 getdents64: 1 53 readlinkat: 1 54 read: 1 55 pread64: 1 56 gettimeofday: 1 57 faccessat: 1 58 exit_group: 1 59 restart_syscall: 1 60 rt_sigreturn: 1 61 getrandom: 1 62 madvise: 1 63 64 # crash dump policy additions 65 clock_gettime: 1 66 getpid: 1 67 gettid: 1 68 pipe2: 1 69 recvmsg: 1 70 process_vm_readv: 1 71 tgkill: 1 72 rt_sigaction: 1 73 rt_tgsigqueueinfo: 1 74 #mprotect: arg2 in 0x1|0x2 75 munmap: 1 76 #mmap: arg2 in 0x1|0x2 77 geteuid: 1 78 getgid: 1 79 getegid: 1 80 getgroups: 1 81 82
