| Harish Mahendrakar | 350b359 | 2018-12-07 17:03:55 -0800 | [diff] [blame] | 1 | # Copyright (C) 2019 The Android Open Source Project |
| 2 | # |
| 3 | # Licensed under the Apache License, Version 2.0 (the "License"); |
| 4 | # you may not use this file except in compliance with the License. |
| 5 | # You may obtain a copy of the License at |
| 6 | # |
| 7 | # http://www.apache.org/licenses/LICENSE-2.0 |
| 8 | # |
| 9 | # Unless required by applicable law or agreed to in writing, software |
| 10 | # distributed under the License is distributed on an "AS IS" BASIS, |
| 11 | # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. |
| 12 | # See the License for the specific language governing permissions and |
| 13 | # limitations under the License. |
| 14 | |
| 15 | futex: 1 |
| 16 | # ioctl calls are filtered via the selinux policy. |
| 17 | ioctl: 1 |
| 18 | sched_yield: 1 |
| 19 | close: 1 |
| 20 | dup: 1 |
| 21 | ppoll: 1 |
| 22 | mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE |
| 23 | mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE |
| 24 | getuid: 1 |
| 25 | getrlimit: 1 |
| 26 | fstat: 1 |
| 27 | newfstatat: 1 |
| 28 | fstatfs: 1 |
| Joel Fernandes | d648399 | 2018-12-22 18:11:34 -0800 | [diff] [blame] | 29 | memfd_create: 1 |
| Joel Fernandes | 3c49347 | 2018-12-22 18:11:34 -0800 | [diff] [blame] | 30 | ftruncate: 1 |
| Harish Mahendrakar | 350b359 | 2018-12-07 17:03:55 -0800 | [diff] [blame] | 31 | |
| 32 | # mremap: Ensure |flags| are (MREMAP_MAYMOVE | MREMAP_FIXED) TODO: Once minijail |
| 33 | # parser support for '<' is in this needs to be modified to also prevent |
| 34 | # |old_address| and |new_address| from touching the exception vector page, which |
| 35 | # on ARM is statically loaded at 0xffff 0000. See |
| 36 | # http://infocenter.arm.com/help/index.jsp?topic=/com.arm.doc.ddi0211h/Babfeega.html |
| 37 | # for more details. |
| 38 | mremap: arg3 == 3 |
| 39 | munmap: 1 |
| 40 | prctl: 1 |
| 41 | writev: 1 |
| 42 | sigaltstack: 1 |
| 43 | clone: 1 |
| 44 | exit: 1 |
| 45 | lseek: 1 |
| 46 | rt_sigprocmask: 1 |
| 47 | openat: 1 |
| 48 | write: 1 |
| 49 | nanosleep: 1 |
| 50 | setpriority: 1 |
| 51 | set_tid_address: 1 |
| 52 | getdents64: 1 |
| 53 | readlinkat: 1 |
| 54 | read: 1 |
| 55 | pread64: 1 |
| 56 | gettimeofday: 1 |
| 57 | faccessat: 1 |
| 58 | exit_group: 1 |
| 59 | restart_syscall: 1 |
| 60 | rt_sigreturn: 1 |
| 61 | getrandom: 1 |
| 62 | madvise: 1 |
| 63 | |
| Marco Nelissen | c6eacf4 | 2019-03-28 10:25:53 -0700 | [diff] [blame] | 64 | # crash dump policy additions |
| 65 | clock_gettime: 1 |
| 66 | getpid: 1 |
| 67 | gettid: 1 |
| 68 | pipe2: 1 |
| 69 | recvmsg: 1 |
| 70 | process_vm_readv: 1 |
| 71 | tgkill: 1 |
| 72 | rt_sigaction: 1 |
| 73 | rt_tgsigqueueinfo: 1 |
| 74 | #mprotect: arg2 in 0x1|0x2 |
| 75 | munmap: 1 |
| 76 | #mmap: arg2 in 0x1|0x2 |
| 77 | geteuid: 1 |
| 78 | getgid: 1 |
| 79 | getegid: 1 |
| 80 | getgroups: 1 |
| 81 | |
| Ray Essick | 4457486 | 2020-02-13 12:39:14 -0800 | [diff] [blame^] | 82 | @include /apex/com.android.media.swcodec/etc/seccomp_policy/code_coverage.arm64.policy |