Create global seccomp policy.
Enabling seccomp across all processes, rather than just zygote, is
useful for auditing the syscall usage of AOSP. Create a global seccomp
policy that can optionally be enabled by init.
Bug: 37960259
Test: confirm global seccomp by removing finit_module from policy and
observing modprobe fail, confirm regular seccomp unchanged by
comparing length of installed bpf
Change-Id: Iac53a42fa26a80b05126f262dd9525f4f66df558
diff --git a/libc/seccomp/seccomp_bpfs.h b/libc/seccomp/seccomp_bpfs.h
index 96e127e..a8f47ca 100644
--- a/libc/seccomp/seccomp_bpfs.h
+++ b/libc/seccomp/seccomp_bpfs.h
@@ -22,15 +22,27 @@
extern const struct sock_filter arm_filter[];
extern const size_t arm_filter_size;
+extern const struct sock_filter arm_global_filter[];
+extern const size_t arm_global_filter_size;
extern const struct sock_filter arm64_filter[];
extern const size_t arm64_filter_size;
+extern const struct sock_filter arm64_global_filter[];
+extern const size_t arm64_global_filter_size;
extern const struct sock_filter x86_filter[];
extern const size_t x86_filter_size;
+extern const struct sock_filter x86_global_filter[];
+extern const size_t x86_global_filter_size;
extern const struct sock_filter x86_64_filter[];
extern const size_t x86_64_filter_size;
+extern const struct sock_filter x86_64_global_filter[];
+extern const size_t x86_64_global_filter_size;
extern const struct sock_filter mips_filter[];
extern const size_t mips_filter_size;
+extern const struct sock_filter mips_global_filter[];
+extern const size_t mips_global_filter_size;
extern const struct sock_filter mips64_filter[];
extern const size_t mips64_filter_size;
+extern const struct sock_filter mips64_global_filter[];
+extern const size_t mips64_global_filter_size;
#endif