# Copyright 2019 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# Copyright 2019 The ChromiumOS Authors
# Use of this source code is governed by a BSD-style license that can be
# found in the LICENSE file.

# This is an allow list of syscalls for most of crosvm devices.
#
# Note that some device policy files don't depend on this policy file
# because of some conflicts such as gpu_common.policy.
# If you want to modify policies for all the devices, please modify
# not only this file but also other *_common.policy files.

brk: 1
clock_gettime: 1
clone: arg0 & CLONE_THREAD
clone3: 1
close: 1
dup3: 1
dup: 1
epoll_create1: 1
epoll_ctl: 1
epoll_pwait: 1
eventfd2: 1
exit: 1
exit_group: 1
ftruncate: 1
futex: 1
getcwd: 1
getpid: 1
gettid: 1
gettimeofday: 1
io_uring_setup: 1
io_uring_register: 1
io_uring_enter: 1
kill: 1
lseek: 1
madvise: arg2 == MADV_DONTNEED || arg2 == MADV_DONTDUMP || arg2 == MADV_REMOVE || arg2 == MADV_MERGEABLE || arg2 == MADV_FREE
membarrier: 1
memfd_create: 1
mmap: arg2 in ~PROT_EXEC
mprotect: arg2 in ~PROT_EXEC
mremap: 1
munmap: 1
nanosleep: 1
clock_nanosleep: 1
pipe2: 1
ppoll: 1
read: 1
readlinkat: 1
readv: 1
recvfrom: 1
recvmsg: 1
restart_syscall: 1
rseq: 1
rt_sigaction: 1
rt_sigprocmask: 1
rt_sigreturn: 1
sched_getaffinity: 1
sched_yield: 1
sendmsg: 1
sendto: 1
set_robust_list: 1
sigaltstack: 1
tgkill: arg2 == SIGABRT
write: 1
writev: 1
fcntl: 1
uname: 1

# ANDROID(b/271625758): disabled to fix duplicate syscall error.
# ## Rules for vmm-swap
# userfaultfd: 1
# # 0xc018aa3f == UFFDIO_API, 0xaa00 == USERFAULTFD_IOC_NEW
# ioctl: arg1 == 0xc018aa3f || arg1 == 0xaa00

statx: 1
getdents64: 1
name_to_handle_at: 1
faccessat: 1
faccessat2: 1
newfstatat: 1
timerfd_create: 1
timerfd_settime: 1
getsockname: 1
openat: 1
setsockopt: 1
bind: 1
socket: arg0 == AF_NETLINK
# The following ioctls are:
# 0x4008550d == USBDEVFS_REAPURBNDELAY
# 0x550b == USBDEVFS_DISCARDURB
# 0x8004550f == USBDEVFS_CLAIMINTERFACE
# 0x80045510 == USBDEVFS_RELEASEINTERFACE
# 0x80045515 == USBDEVFS_CLEAR_HALT
# 0x8004551a == USBDEVFS_GET_CAPABILITIES
# 0x8038550a == USBDEVFS_SUBMITURB
# 0xc0185500 == USBDEVFS_CONTROL
# 0x5514 == USBDEVFS_RESET
# 0x80045505 == USBDEVFS_SETCONFIGURATION
# 0x8108551b == USBDEVFS_DISCONNECT_CLAIM
# 0x40085511 == USBDEVFS_CONNECTINFO
# 0x80185520 == USBDEVFS_CONNINFO_EX
# 0x551f == USBDEVFS_GET_SPEED
# 0x8008551c == USBDEVFS_ALLOC_STREAMS
# 0x8008551d == USBDEVFS_FREE_STREAMS
# 0x80085504 == USBDEVFS_SETINTERFACE
# 0x80044801 == HIDIOCGRDESCSIZE
# 0x90044802 == HIDIOCGRDESC
ioctl: arg1 == 0xc0185500 || arg1 == 0x8038550a || arg1 == 0x8004551a || arg1 == 0x4008550d || arg1 == 0x8004550f || arg1 == 0x80045510 || arg1 == 0x80045515 || arg1 == 0x550b || arg1 == 0x5514 || arg1 == 0x80045505 || arg1 == 0x8108551b || arg1 == 0x40085511 || arg1 == 0x80185520 || arg1 == 0x551f || arg1 == 0x8008551c || arg1 == 0x8008551d || arg1 == 0x80085504 || arg1 == 0x80044801 || arg1 == 0x90044802
fstat: 1
getrandom: 1
prctl: arg0 == PR_SET_NAME