seccomp_lists.go

// SPDX-License-Identifier: GPL-2.0-only OR GPL-3.0-only
// Copyright (C) 2021-2022 Felix Geyer <debfx@fobos.de>

package main

// allowed with some restrictions:
// personality, socket
// allowed here but restrictions in another filter:
// clone, ioctl
var SeccompAllow = []string{
	"accept",
	"accept4",
	"access",
	"adjtimex",
	"alarm",
	"bind",
	"brk",
	"capget",
	"capset",
	"chdir",
	"chmod",
	"chown",
	"chown32",
	"clock_adjtime",
	"clock_adjtime64",
	"clock_getres",
	"clock_getres_time64",
	"clock_gettime",
	"clock_gettime64",
	"clock_nanosleep",
	"clock_nanosleep_time64",
	"clone",
	"close",
	"close_range",
	"connect",
	"copy_file_range",
	"creat",
	"dup",
	"dup2",
	"dup3",
	"epoll_create",
	"epoll_create1",
	"epoll_ctl",
	"epoll_ctl_old",
	"epoll_pwait",
	"epoll_pwait2",
	"epoll_wait",
	"epoll_wait_old",
	"eventfd",
	"eventfd2",
	"execve",
	"execveat",
	"exit",
	"exit_group",
	"faccessat",
	"faccessat2",
	"fadvise64",
	"fadvise64_64",
	"fallocate",
	"fanotify_mark",
	"fchdir",
	"fchmod",
	"fchmodat",
	"fchown",
	"fchown32",
	"fchownat",
	"fcntl",
	"fcntl64",
	"fdatasync",
	"fgetxattr",
	"flistxattr",
	"flock",
	"fork",
	"fremovexattr",
	"fsetxattr",
	"fstat",
	"fstat64",
	"fstatat64",
	"fstatfs",
	"fstatfs64",
	"fsync",
	"ftruncate",
	"ftruncate64",
	"futex",
	"futex_time64",
	"futex_waitv",
	"futimesat",
	"getcpu",
	"getcwd",
	"getdents",
	"getdents64",
	"getegid",
	"getegid32",
	"geteuid",
	"geteuid32",
	"getgid",
	"getgid32",
	"getgroups",
	"getgroups32",
	"getitimer",
	"getpeername",
	"getpgid",
	"getpgrp",
	"getpid",
	"getppid",
	"getpriority",
	"getrandom",
	"getresgid",
	"getresgid32",
	"getresuid",
	"getresuid32",
	"getrlimit",
	"get_robust_list",
	"getrusage",
	"getsid",
	"getsockname",
	"getsockopt",
	"get_thread_area",
	"gettid",
	"gettimeofday",
	"getuid",
	"getuid32",
	"getxattr",
	"inotify_add_watch",
	"inotify_init",
	"inotify_init1",
	"inotify_rm_watch",
	"io_cancel",
	"ioctl",
	"io_destroy",
	"io_getevents",
	"io_pgetevents",
	"io_pgetevents_time64",
	"ioprio_get",
	"ioprio_set",
	"io_setup",
	"io_submit",
	"ipc",
	"kill",
	"landlock_add_rule",
	"landlock_create_ruleset",
	"landlock_restrict_self",
	"lchown",
	"lchown32",
	"lgetxattr",
	"link",
	"linkat",
	"listen",
	"listxattr",
	"llistxattr",
	"_llseek",
	"lremovexattr",
	"lseek",
	"lsetxattr",
	"lstat",
	"lstat64",
	"madvise",
	"membarrier",
	"memfd_create",
	"memfd_secret",
	"mincore",
	"mkdir",
	"mkdirat",
	"mknod",
	"mknodat",
	"mlock",
	"mlock2",
	"mlockall",
	"mmap",
	"mmap2",
	"mprotect",
	"mq_getsetattr",
	"mq_notify",
	"mq_open",
	"mq_timedreceive",
	"mq_timedreceive_time64",
	"mq_timedsend",
	"mq_timedsend_time64",
	"mq_unlink",
	"mremap",
	"msgctl",
	"msgget",
	"msgrcv",
	"msgsnd",
	"msync",
	"munlock",
	"munlockall",
	"munmap",
	"nanosleep",
	"newfstatat",
	"_newselect",
	"open",
	"openat",
	"openat2",
	"pause",
	"pidfd_open",
	"pidfd_send_signal",
	"pipe",
	"pipe2",
	"pkey_alloc",
	"pkey_free",
	"pkey_mprotect",
	"poll",
	"ppoll",
	"ppoll_time64",
	"prctl",
	"pread64",
	"preadv",
	"preadv2",
	"prlimit64",
	"process_mrelease",
	"pselect6",
	"pselect6_time64",
	"pwrite64",
	"pwritev",
	"pwritev2",
	"read",
	"readahead",
	"readlink",
	"readlinkat",
	"readv",
	"recv",
	"recvfrom",
	"recvmmsg",
	"recvmmsg_time64",
	"recvmsg",
	"remap_file_pages",
	"removexattr",
	"rename",
	"renameat",
	"renameat2",
	"restart_syscall",
	"rmdir",
	"rseq",
	"rt_sigaction",
	"rt_sigpending",
	"rt_sigprocmask",
	"rt_sigqueueinfo",
	"rt_sigreturn",
	"rt_sigsuspend",
	"rt_sigtimedwait",
	"rt_sigtimedwait_time64",
	"rt_tgsigqueueinfo",
	"sched_getaffinity",
	"sched_getattr",
	"sched_getparam",
	"sched_get_priority_max",
	"sched_get_priority_min",
	"sched_getscheduler",
	"sched_rr_get_interval",
	"sched_rr_get_interval_time64",
	"sched_setaffinity",
	"sched_setattr",
	"sched_setparam",
	"sched_setscheduler",
	"sched_yield",
	"seccomp",
	"select",
	"semctl",
	"semget",
	"semop",
	"semtimedop",
	"semtimedop_time64",
	"send",
	"sendfile",
	"sendfile64",
	"sendmmsg",
	"sendmsg",
	"sendto",
	"setfsgid",
	"setfsgid32",
	"setfsuid",
	"setfsuid32",
	"setgid",
	"setgid32",
	"setgroups",
	"setgroups32",
	"setitimer",
	"setpgid",
	"setpriority",
	"setregid",
	"setregid32",
	"setresgid",
	"setresgid32",
	"setresuid",
	"setresuid32",
	"setreuid",
	"setreuid32",
	"setrlimit",
	"set_robust_list",
	"setsid",
	"setsockopt",
	"set_thread_area",
	"set_tid_address",
	"setuid",
	"setuid32",
	"setxattr",
	"shmat",
	"shmctl",
	"shmdt",
	"shmget",
	"shutdown",
	"sigaltstack",
	"signalfd",
	"signalfd4",
	"sigprocmask",
	"sigreturn",
	"socketcall",
	"socketpair",
	"splice",
	"stat",
	"stat64",
	"statfs",
	"statfs64",
	"statx",
	"symlink",
	"symlinkat",
	"sync",
	"sync_file_range",
	"syncfs",
	"sysinfo",
	"tee",
	"tgkill",
	"time",
	"timer_create",
	"timer_delete",
	"timer_getoverrun",
	"timer_gettime",
	"timer_gettime64",
	"timer_settime",
	"timer_settime64",
	"timerfd_create",
	"timerfd_gettime",
	"timerfd_gettime64",
	"timerfd_settime",
	"timerfd_settime64",
	"times",
	"tkill",
	"truncate",
	"truncate64",
	"ugetrlimit",
	"umask",
	"uname",
	"unlink",
	"unlinkat",
	"utime",
	"utimensat",
	"utimensat_time64",
	"utimes",
	"vfork",
	"vmsplice",
	"wait4",
	"waitid",
	"waitpid",
	"write",
	"writev",
	"arm_fadvise64_64",
	"arm_sync_file_range",
	"sync_file_range2",
	"swapcontext",
	"breakpoint",
	"cacheflush",
	"set_tls",
	"arch_prctl",
	"modify_ldt",
	"s390_pci_mmio_read",
	"s390_pci_mmio_write",
	"s390_runtime_instr",
}

var SeccompAllowDevel = []string{
	"process_vm_readv",
	"process_vm_writev",
	"ptrace",
}

/*
blocked but not part of this list so ENOSYS is returned instead:
"clone3",
"io_uring_enter",
"io_uring_register",
"io_uring_setup",
*/
var SeccompEperm = []string{
	"_sysctl",
	"acct",
	"add_key",
	"afs_syscall",
	"bdflush",
	"bpf",
	"break",
	"cachectl",
	"chroot",
	"clock_settime",
	"clock_settime64",
	"create_module",
	"delete_module",
	"fanotify_init",
	"finit_module",
	"fsconfig",
	"fsmount",
	"fsopen",
	"fspick",
	"ftime",
	"get_kernel_syms",
	"get_mempolicy",
	"get_tls",
	"getpmsg",
	"gtty",
	"idle",
	"init_module",
	"ioperm",
	"iopl",
	"kcmp",
	"kexec_file_load",
	"kexec_load",
	"keyctl",
	"landlock_add_rule",
	"landlock_create_ruleset",
	"landlock_restrict_self",
	"lock",
	"lookup_dcookie",
	"mbind",
	"migrate_pages",
	"mount",
	"mount_setattr",
	"move_mount",
	"move_pages",
	"mpx",
	"multiplexer",
	"name_to_handle_at",
	"nfsservctl",
	"nice",
	"oldfstat",
	"oldlstat",
	"oldolduname",
	"oldstat",
	"olduname",
	"open_by_handle_at",
	"open_tree",
	"pciconfig_iobase",
	"pciconfig_read",
	"pciconfig_write",
	"perf_event_open",
	"pidfd_getfd",
	"pivot_root",
	"process_madvise",
	"prof",
	"profil",
	"putpmsg",
	"query_module",
	"quotactl",
	"quotactl_fd",
	"readdir",
	"reboot",
	"request_key",
	"riscv_flush_icache",
	"rtas",
	"s390_guarded_storage",
	"s390_sthyi",
	"security",
	"set_mempolicy",
	"set_mempolicy_home_node",
	"setdomainname",
	"sethostname",
	"setns",
	"settimeofday",
	"sgetmask",
	"sigaction",
	"signal",
	"sigpending",
	"sigsuspend",
	"spu_create",
	"spu_run",
	"ssetmask",
	"stime",
	"stty",
	"subpage_prot",
	"swapcontext",
	"swapoff",
	"swapon",
	"switch_endian",
	"sys_debug_setcontext",
	"syscall",
	"sysfs",
	"syslog",
	"sysmips",
	"timerfd",
	"tuxcall",
	"ulimit",
	"umount",
	"umount2",
	"unshare",
	"uselib",
	"userfaultfd",
	"usr26",
	"usr32",
	"ustat",
	"vhangup",
	"vm86",
	"vm86old",
	"vserver",
}

var SeccompMinimalEperm = []string{
	"unshare",
	"setns",
	"mount",
	"umount",
	"umount2",
	"pivot_root",
	"chroot",
}

var SeccompMinimalEnosys = []string{
	"clone3",
	"open_tree",
	"move_mount",
	"fsopen",
	"fsconfig",
	"fsmount",
	"fspick",
	"mount_setattr",
}