1# Copyright (c) 2023 Huawei Device Co., Ltd. 2# Licensed under the Apache License, Version 2.0 (the "License"); 3# you may not use this file except in compliance with the License. 4# You may obtain a copy of the License at 5# 6# http://www.apache.org/licenses/LICENSE-2.0 7# 8# Unless required by applicable law or agreed to in writing, software 9# distributed under the License is distributed on an "AS IS" BASIS, 10# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. 11# See the License for the specific language governing permissions and 12# limitations under the License. 13 14# For now, it supports architechture of ['arm', 'arm64', 'riscv64']. 15 16@returnValue 17TRAP 18 19@headFiles 20<linux/sched.h> 21<stdint.h> 22 23@priority 24ioctl;all 25futex;all 26 27@allowList 28io_setup;all 29io_destroy;all 30io_submit;all 31io_cancel;all 32io_getevents;all 33setxattr;all 34lsetxattr;all 35fsetxattr;all 36getxattr;all 37lgetxattr;all 38fgetxattr;all 39listxattr;all 40llistxattr;all 41flistxattr;all 42removexattr;all 43lremovexattr;all 44fremovexattr;all 45getcwd;all 46eventfd2;all 47epoll_create1;all 48epoll_ctl;all 49epoll_pwait;all 50dup;all 51dup3;all 52fcntl;all 53inotify_init1;all 54inotify_add_watch;all 55inotify_rm_watch;all 56ioctl;all 57ioprio_set;arm64 58ioprio_set;riscv64 59ioprio_get;arm64 60ioprio_get;riscv64 61flock;all 62mknodat;all 63mkdirat;all 64unlinkat;all 65symlinkat;all 66linkat;all 67renameat;arm 68renameat;arm64 69pivot_root;riscv64 70statfs;arm64 71statfs;riscv64 72fstatfs;arm64 73fstatfs;riscv64 74truncate;all 75ftruncate;arm64 76ftruncate;riscv64 77fallocate;all 78faccessat;all 79chdir;all 80fchdir;all 81fchmod;all 82fchmodat;all 83fchownat;all 84fchown;arm64 85fchown;riscv64 86openat;all 87close;all 88pipe2;all 89quotactl;all 90getdents64;all 91lseek;all 92read;all 93write;all 94readv;all 95writev;all 96pread64;all 97pwrite64;all 98preadv;all 99pwritev;all 100sendfile;all 101pselect6;all 102ppoll;all 103signalfd4;all 104vmsplice;all 105splice;all 106tee;all 107readlinkat;all 108newfstatat;arm64 109newfstatat;riscv64 110fstat;arm64 111fstat;riscv64 112sync;all 113fsync;all 114fdatasync;all 115sync_file_range;arm64 116sync_file_range;riscv64 117timerfd_create;all 118timerfd_settime;all 119timerfd_gettime;all 120utimensat;all 121capget;all 122capset;all 123personality;all 124exit;all 125exit_group;all 126waitid;all 127set_tid_address;all 128futex;all 129nanosleep;all 130getitimer;all 131setitimer;all 132timer_create;all 133timer_gettime;all 134timer_getoverrun;all 135timer_settime;all 136timer_delete;all 137clock_gettime;all 138clock_getres;all 139clock_nanosleep;all 140ptrace;all 141sched_setparam;all 142sched_setscheduler;all 143sched_getscheduler;all 144sched_getparam;all 145sched_setaffinity;all 146sched_getaffinity;all 147sched_yield;all 148sched_get_priority_max;all 149sched_get_priority_min;all 150sched_rr_get_interval;all 151restart_syscall;all 152kill;all 153tkill;all 154tgkill;all 155sigaltstack;all 156rt_sigsuspend;all 157rt_sigaction;all 158rt_sigprocmask;all 159rt_sigpending;all 160rt_sigtimedwait;all 161rt_sigqueueinfo;all 162rt_sigreturn;all 163setpriority;all 164getpriority;all 165setresgid;arm64 166setresgid;riscv64 167setgid;arm64 168setgid;riscv64 169setuid;arm64 170setuid;riscv64 171setresuid;arm64 172setresuid;riscv64 173getresuid;arm64 174getresuid;riscv64 175getresgid;arm64 176getresgid;riscv64 177times;all 178setpgid;all 179getpgid;all 180getsid;all 181setsid;all 182getgroups;arm64 183getgroups;riscv64 184setgroups;arm64 185setgroups;riscv64 186uname;all 187getrlimit;arm64 188getrlimit;riscv64 189setrlimit;all 190getrusage;all 191umask;all 192prctl;all 193getcpu;all 194gettimeofday;all 195getpid;all 196getppid;all 197getuid;all 198geteuid;arm64 199geteuid;riscv64 200getgid;arm64 201getgid;riscv64 202getegid;arm64 203getegid;riscv64 204gettid;all 205sysinfo;all 206socket;all 207socketpair;all 208bind;all 209listen;all 210accept;all 211connect;all 212getsockname;all 213getpeername;all 214sendto;all 215recvfrom;all 216setsockopt;all 217getsockopt;all 218shutdown;all 219sendmsg;all 220recvmsg;all 221readahead;all 222brk;all 223munmap;all 224mremap;all 225execve;all 226mmap;arm64 227mmap;riscv64 228fadvise64;arm64 229fadvise64;riscv64 230mprotect;all 231msync;all 232mlock;all 233munlock;all 234mlockall;all 235munlockall;all 236mincore;all 237madvise;all 238rt_tgsigqueueinfo;all 239perf_event_open;all 240accept4;all 241recvmmsg;all 242wait4;all 243prlimit64;all 244syncfs;all 245sendmmsg;all 246process_vm_readv;all 247process_vm_writev;all 248sched_setattr;all 249sched_getattr;all 250renameat2;all 251seccomp;all 252getrandom;all 253memfd_create;all 254execveat;all 255userfaultfd;all 256membarrier;all 257mlock2;all 258copy_file_range;all 259preadv2;all 260pwritev2;all 261statx;all 262pidfd_send_signal;all 263pidfd_open;all 264pidfd_getfd;all 265faccessat2;all 266process_madvise;all 267set_robust_list;all 268fork;arm 269open;arm 270creat;arm 271link;arm 272unlink;arm 273chmod;arm 274access;arm 275rename;arm 276mkdir;arm 277rmdir;arm 278pipe;arm 279dup2;arm 280sigaction;arm 281symlink;arm 282readlink;arm 283sigreturn;arm 284_llseek;arm 285getdents;arm 286_newselect;arm 287poll;arm 288vfork;arm 289ugetrlimit;arm 290mmap2;arm 291truncate64;arm 292ftruncate64;arm 293stat64;arm 294lstat64;arm 295fstat64;arm 296lchown32;arm 297getuid32;arm 298getgid32;arm 299geteuid32;arm 300getegid32;arm 301getgroups32;arm 302fchown32;arm 303setgroups32;arm 304setresuid32;arm 305setresgid32;arm 306getresuid32;arm 307getresgid32;arm 308chown32;arm 309setuid32;arm 310setgid32;arm 311fcntl64;arm 312sendfile64;arm 313epoll_create;arm 314epoll_wait;arm 315remap_file_pages;arm 316statfs64;arm 317fstatfs64;arm 318fadvise64_64;arm 319inotify_init;arm 320fstatat64;arm 321sync_file_range2;arm 322eventfd;arm 323clock_gettime64;arm 324clock_settime64;arm 325clock_adjtime64;arm 326clock_getres_time64;arm 327clock_nanosleep_time64;arm 328timer_gettime64;arm 329timer_settime64;arm 330timerfd_gettime64;arm 331timerfd_settime64;arm 332utimensat_time64;arm 333pselect6_time64;arm 334ppoll_time64;arm 335recvmmsg_time64;arm 336semtimedop_time64;arm 337rt_sigtimedwait_time64;arm 338futex_time64;arm 339sched_rr_get_interval_time64;arm 340cacheflush;arm 341set_tls;arm 342 343@allowListWithArgs 344clone: if (arg0 & (CLONE_NEWNS | CLONE_NEWPID | CLONE_NEWNET | CLONE_NEWCGROUP | CLONE_NEWUTS | CLONE_NEWIPC | CLONE_NEWUSER)) == 0 ; return ALLOW; else return TRAP;all 345