crosvm/tests/plugin.policy
Daniel Verkamp 8d70c18b16 tests: plugin: add clone3 and rseq to seccomp policy
These syscalls are used by the plugin test child process on newer glibc
and kernel versions. Without them, the plugin tests fail because the
child processes die with SIGSYS.

BUG=None
TEST=tools/dev_container tools/presubmit --all

Change-Id: Id56831cf146e1e0f24f700744d6db902133ecc62
Reviewed-on: https://chromium-review.googlesource.com/c/crosvm/crosvm/+/4034381
Reviewed-by: Zihan Chen <zihanchen@google.com>
Commit-Queue: Daniel Verkamp <dverkamp@chromium.org>
2022-11-17 18:59:56 +00:00

55 lines
909 B
Text

# Copyright 2017 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.
close: 1
dup: 1
dup2: 1
execve: 1
exit_group: 1
futex: 1
kill: 1
lseek: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
munmap: 1
read: 1
recvfrom: 1
sched_getaffinity: 1
set_robust_list: 1
sigaltstack: 1
# Disallow clone's other than new threads.
clone: arg0 & 0x00010000
clone3: 1
write: 1
eventfd2: 1
poll: 1
getpid: 1
getppid: 1
# Allow PR_SET_NAME only.
prctl: arg0 == 15
rseq: 1
access: 1
arch_prctl: 1
brk: 1
exit: 1
fcntl: 1
fstat: 1
ftruncate: 1
getcwd: 1
getrlimit: 1
# TUNGETFEATURES
ioctl: arg1 == 0x800454CF
madvise: 1
memfd_create: 1
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
open: 1
openat: 1
prlimit64: arg2 == 0 && arg3 != 0
recvmsg: 1
restart_syscall: 1
rt_sigaction: 1
rt_sigprocmask: 1
sendmsg: 1
set_tid_address: 1
stat: 1
writev: 1