# Copyright 2018 The Chromium OS Authors. All rights reserved.
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# This file lists out the seccomp policy for allowed syscalls on arc-adbd.

mmap: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
stat: 1
mprotect: arg2 in ~PROT_EXEC || arg2 in ~PROT_WRITE
close: 1
open: 1
openat: 1
read: 1
fstat: 1
write: 1
creat: 1
chown: 1
access: 1
mount: arg3 == MS_BIND || arg3 == MS_NOSUID|MS_NODEV|MS_NOEXEC
rename: 1
# mknod should only be used to create FIFOs. 010777 means
# S_IFIFO|S_IRWXU|S_IRWXG|S_IRWXO.
mknod: arg1 in 010777
brk: 1
mkdir: 1
lstat: 1
unlink: 1
symlink: 1
rt_sigaction: 1
getdents: 1
restart_syscall: 1
exit: 1
exit_group: 1
rt_sigreturn: 1
rt_sigprocmask: 1
munmap: 1
tgkill: 1
sendto: 1
gettid:1
futex:1

# For modprobe(8)
clone: 1
execve: 1
wait4: 1
set_robust_list: 1
dup2: 1
getrlimit: 1
getdents64: 1
prctl: 1
arch_prctl: 1
uname: 1
newfstatat: 1
fcntl: 1
lseek: 1
finit_module: 1

# For brillo::kLogToStderrIfTty. isatty(0) calls ioctl(0, TCGETS, *).
ioctl: arg0 == 0 && arg1 == TCGETS
getpid: 1
prlimit64: arg2 == 0 && arg3 != 0

# For syslog /dev/log
socket: arg0 == AF_UNIX
connect: 1