# Copyright 2020 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# This file lists out the seccomp policy.

# The following are generic syscalls.
openat: 1
stat: 1
fstat: 1
close: 1
read: 1
access: 1
munmap: 1
set_robust_list: 1
rt_sigprocmask: 1
write: 1
exit_group: 1

# The following are syscalls enabled by -L in minijail.
connect: 1
lseek: 1

# The following are syscalls required for pwmgetfanrpm.
mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
# CROS_EC_DEV_IOCRDMEM_V2 = 0xc108ec01
# CROS_EC_DEV_IOCXCMD = 0xc0283a00
# CROS_EC_DEV_IOCXCMD_V2 = 0xc014ec0
# CROS_EC_DEV_IOCRDMEM = 0x0c0103a01
ioctl: arg1 == 0xc108ec01 || arg1 == 0xc0283a00 || arg1 == 0xc014ec00 || \
       arg1 == 0x0c0103a01
brk: 1
rt_sigaction: 1
execve: 1
arch_prctl: 1
set_tid_address: 1
prlimit64: 1
uname: 1