2016-02-08 11:19:21 -05:00
|
|
|
{
|
2016-02-18 00:06:07 -05:00
|
|
|
"defaultAction": "SCMP_ACT_ERRNO",
|
2021-07-30 10:47:17 -04:00
|
|
|
"defaultErrnoRet": 1,
|
2016-07-13 09:41:30 -04:00
|
|
|
"archMap": [
|
2016-02-08 11:19:21 -05:00
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_X86_64",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_X86",
|
|
|
|
|
"SCMP_ARCH_X32"
|
|
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
|
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_AARCH64",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_ARM"
|
|
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
|
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_MIPS64",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_MIPS",
|
|
|
|
|
"SCMP_ARCH_MIPS64N32"
|
|
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
|
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_MIPS64N32",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_MIPS",
|
|
|
|
|
"SCMP_ARCH_MIPS64"
|
|
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
|
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_MIPSEL64",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_MIPSEL",
|
|
|
|
|
"SCMP_ARCH_MIPSEL64N32"
|
|
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
|
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_MIPSEL64N32",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_MIPSEL",
|
|
|
|
|
"SCMP_ARCH_MIPSEL64"
|
|
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
|
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"architecture": "SCMP_ARCH_S390X",
|
|
|
|
|
"subArchitectures": [
|
|
|
|
|
"SCMP_ARCH_S390"
|
|
|
|
|
]
|
2022-05-02 04:08:56 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"architecture": "SCMP_ARCH_RISCV64",
|
|
|
|
|
"subArchitectures": null
|
2016-07-13 09:41:30 -04:00
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"syscalls": [
|
2016-05-06 10:17:41 -04:00
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"names": [
|
|
|
|
|
"accept",
|
|
|
|
|
"accept4",
|
|
|
|
|
"access",
|
2017-05-23 01:42:47 -04:00
|
|
|
"adjtimex",
|
2016-07-13 09:41:30 -04:00
|
|
|
"alarm",
|
|
|
|
|
"bind",
|
|
|
|
|
"brk",
|
|
|
|
|
"capget",
|
|
|
|
|
"capset",
|
|
|
|
|
"chdir",
|
|
|
|
|
"chmod",
|
|
|
|
|
"chown",
|
|
|
|
|
"chown32",
|
seccomp: Whitelist `clock_adjtime`
This only allows making the syscall. CAP_SYS_TIME is still required
for time adjustment (enforced by the kernel):
```
kernel/time/posix-timers.c:
1112 SYSCALL_DEFINE2(clock_adjtime, const clockid_t, which_clock,
1113 struct __kernel_timex __user *, utx)
...
1121 err = do_clock_adjtime(which_clock, &ktx);
1100 int do_clock_adjtime(const clockid_t which_clock, struct __kernel_timex * ktx)
1101 {
...
1109 return kc->clock_adj(which_clock, ktx);
1299 static const struct k_clock clock_realtime = {
...
1304 .clock_adj = posix_clock_realtime_adj,
188 static int posix_clock_realtime_adj(const clockid_t which_clock,
189 struct __kernel_timex *t)
190 {
191 return do_adjtimex(t);
kernel/time/timekeeping.c:
2312 int do_adjtimex(struct __kernel_timex *txc)
2313 {
...
2321 /* Validate the data before disabling interrupts */
2322 ret = timekeeping_validate_timex(txc);
2246 static int timekeeping_validate_timex(const struct __kernel_timex *txc)
2247 {
2248 if (txc->modes & ADJ_ADJTIME) {
...
2252 if (!(txc->modes & ADJ_OFFSET_READONLY) &&
2253 !capable(CAP_SYS_TIME))
2254 return -EPERM;
2255 } else {
2256 /* In order to modify anything, you gotta be super-user! */
2257 if (txc->modes && !capable(CAP_SYS_TIME))
2258 return -EPERM;
```
Fixes: https://github.com/moby/moby/issues/40919
Signed-off-by: Stanislav Levin <slev@altlinux.org>
2020-05-08 03:58:16 -04:00
|
|
|
"clock_adjtime",
|
|
|
|
|
"clock_adjtime64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"clock_getres",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"clock_getres_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"clock_gettime",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"clock_gettime64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"clock_nanosleep",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"clock_nanosleep_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"close",
|
2021-01-17 07:39:31 -05:00
|
|
|
"close_range",
|
2016-07-13 09:41:30 -04:00
|
|
|
"connect",
|
|
|
|
|
"copy_file_range",
|
|
|
|
|
"creat",
|
|
|
|
|
"dup",
|
|
|
|
|
"dup2",
|
|
|
|
|
"dup3",
|
|
|
|
|
"epoll_create",
|
|
|
|
|
"epoll_create1",
|
|
|
|
|
"epoll_ctl",
|
|
|
|
|
"epoll_ctl_old",
|
|
|
|
|
"epoll_pwait",
|
2021-01-17 07:39:31 -05:00
|
|
|
"epoll_pwait2",
|
2016-07-13 09:41:30 -04:00
|
|
|
"epoll_wait",
|
|
|
|
|
"epoll_wait_old",
|
|
|
|
|
"eventfd",
|
|
|
|
|
"eventfd2",
|
|
|
|
|
"execve",
|
|
|
|
|
"execveat",
|
|
|
|
|
"exit",
|
|
|
|
|
"exit_group",
|
|
|
|
|
"faccessat",
|
2020-08-17 09:13:03 -04:00
|
|
|
"faccessat2",
|
2016-07-13 09:41:30 -04:00
|
|
|
"fadvise64",
|
|
|
|
|
"fadvise64_64",
|
|
|
|
|
"fallocate",
|
|
|
|
|
"fanotify_mark",
|
|
|
|
|
"fchdir",
|
|
|
|
|
"fchmod",
|
|
|
|
|
"fchmodat",
|
|
|
|
|
"fchown",
|
|
|
|
|
"fchown32",
|
|
|
|
|
"fchownat",
|
|
|
|
|
"fcntl",
|
|
|
|
|
"fcntl64",
|
|
|
|
|
"fdatasync",
|
|
|
|
|
"fgetxattr",
|
|
|
|
|
"flistxattr",
|
|
|
|
|
"flock",
|
|
|
|
|
"fork",
|
|
|
|
|
"fremovexattr",
|
|
|
|
|
"fsetxattr",
|
|
|
|
|
"fstat",
|
|
|
|
|
"fstat64",
|
|
|
|
|
"fstatat64",
|
|
|
|
|
"fstatfs",
|
|
|
|
|
"fstatfs64",
|
|
|
|
|
"fsync",
|
|
|
|
|
"ftruncate",
|
|
|
|
|
"ftruncate64",
|
|
|
|
|
"futex",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"futex_time64",
|
2022-05-13 05:20:48 -04:00
|
|
|
"futex_waitv",
|
2016-07-13 09:41:30 -04:00
|
|
|
"futimesat",
|
|
|
|
|
"getcpu",
|
|
|
|
|
"getcwd",
|
|
|
|
|
"getdents",
|
|
|
|
|
"getdents64",
|
|
|
|
|
"getegid",
|
|
|
|
|
"getegid32",
|
|
|
|
|
"geteuid",
|
|
|
|
|
"geteuid32",
|
|
|
|
|
"getgid",
|
|
|
|
|
"getgid32",
|
|
|
|
|
"getgroups",
|
|
|
|
|
"getgroups32",
|
|
|
|
|
"getitimer",
|
|
|
|
|
"getpeername",
|
|
|
|
|
"getpgid",
|
|
|
|
|
"getpgrp",
|
|
|
|
|
"getpid",
|
|
|
|
|
"getppid",
|
|
|
|
|
"getpriority",
|
|
|
|
|
"getrandom",
|
|
|
|
|
"getresgid",
|
|
|
|
|
"getresgid32",
|
|
|
|
|
"getresuid",
|
|
|
|
|
"getresuid32",
|
|
|
|
|
"getrlimit",
|
|
|
|
|
"get_robust_list",
|
|
|
|
|
"getrusage",
|
|
|
|
|
"getsid",
|
|
|
|
|
"getsockname",
|
|
|
|
|
"getsockopt",
|
|
|
|
|
"get_thread_area",
|
|
|
|
|
"gettid",
|
|
|
|
|
"gettimeofday",
|
|
|
|
|
"getuid",
|
|
|
|
|
"getuid32",
|
|
|
|
|
"getxattr",
|
|
|
|
|
"inotify_add_watch",
|
|
|
|
|
"inotify_init",
|
|
|
|
|
"inotify_init1",
|
|
|
|
|
"inotify_rm_watch",
|
|
|
|
|
"io_cancel",
|
|
|
|
|
"ioctl",
|
|
|
|
|
"io_destroy",
|
|
|
|
|
"io_getevents",
|
2019-03-18 14:14:56 -04:00
|
|
|
"io_pgetevents",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"io_pgetevents_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"ioprio_get",
|
|
|
|
|
"ioprio_set",
|
|
|
|
|
"io_setup",
|
|
|
|
|
"io_submit",
|
2019-06-25 13:05:22 -04:00
|
|
|
"io_uring_enter",
|
|
|
|
|
"io_uring_register",
|
|
|
|
|
"io_uring_setup",
|
2016-07-13 09:41:30 -04:00
|
|
|
"ipc",
|
|
|
|
|
"kill",
|
2022-01-30 13:08:46 -05:00
|
|
|
"landlock_add_rule",
|
|
|
|
|
"landlock_create_ruleset",
|
|
|
|
|
"landlock_restrict_self",
|
2016-07-13 09:41:30 -04:00
|
|
|
"lchown",
|
|
|
|
|
"lchown32",
|
|
|
|
|
"lgetxattr",
|
|
|
|
|
"link",
|
|
|
|
|
"linkat",
|
|
|
|
|
"listen",
|
|
|
|
|
"listxattr",
|
|
|
|
|
"llistxattr",
|
|
|
|
|
"_llseek",
|
|
|
|
|
"lremovexattr",
|
|
|
|
|
"lseek",
|
|
|
|
|
"lsetxattr",
|
|
|
|
|
"lstat",
|
|
|
|
|
"lstat64",
|
|
|
|
|
"madvise",
|
2020-03-23 10:51:08 -04:00
|
|
|
"membarrier",
|
2016-07-13 09:41:30 -04:00
|
|
|
"memfd_create",
|
2022-05-13 05:20:48 -04:00
|
|
|
"memfd_secret",
|
2016-07-13 09:41:30 -04:00
|
|
|
"mincore",
|
|
|
|
|
"mkdir",
|
|
|
|
|
"mkdirat",
|
|
|
|
|
"mknod",
|
|
|
|
|
"mknodat",
|
|
|
|
|
"mlock",
|
|
|
|
|
"mlock2",
|
|
|
|
|
"mlockall",
|
|
|
|
|
"mmap",
|
|
|
|
|
"mmap2",
|
|
|
|
|
"mprotect",
|
|
|
|
|
"mq_getsetattr",
|
|
|
|
|
"mq_notify",
|
|
|
|
|
"mq_open",
|
|
|
|
|
"mq_timedreceive",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"mq_timedreceive_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"mq_timedsend",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"mq_timedsend_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"mq_unlink",
|
|
|
|
|
"mremap",
|
|
|
|
|
"msgctl",
|
|
|
|
|
"msgget",
|
|
|
|
|
"msgrcv",
|
|
|
|
|
"msgsnd",
|
|
|
|
|
"msync",
|
|
|
|
|
"munlock",
|
|
|
|
|
"munlockall",
|
|
|
|
|
"munmap",
|
|
|
|
|
"nanosleep",
|
|
|
|
|
"newfstatat",
|
|
|
|
|
"_newselect",
|
|
|
|
|
"open",
|
|
|
|
|
"openat",
|
2020-08-16 03:58:57 -04:00
|
|
|
"openat2",
|
2016-07-13 09:41:30 -04:00
|
|
|
"pause",
|
2020-11-11 07:32:51 -05:00
|
|
|
"pidfd_open",
|
|
|
|
|
"pidfd_send_signal",
|
2016-07-13 09:41:30 -04:00
|
|
|
"pipe",
|
|
|
|
|
"pipe2",
|
|
|
|
|
"poll",
|
|
|
|
|
"ppoll",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"ppoll_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"prctl",
|
|
|
|
|
"pread64",
|
|
|
|
|
"preadv",
|
2017-03-07 17:19:46 -05:00
|
|
|
"preadv2",
|
2016-07-13 09:41:30 -04:00
|
|
|
"prlimit64",
|
2022-05-13 05:20:48 -04:00
|
|
|
"process_mrelease",
|
2016-07-13 09:41:30 -04:00
|
|
|
"pselect6",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"pselect6_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"pwrite64",
|
|
|
|
|
"pwritev",
|
2017-03-07 17:19:46 -05:00
|
|
|
"pwritev2",
|
2016-07-13 09:41:30 -04:00
|
|
|
"read",
|
|
|
|
|
"readahead",
|
|
|
|
|
"readlink",
|
|
|
|
|
"readlinkat",
|
|
|
|
|
"readv",
|
|
|
|
|
"recv",
|
|
|
|
|
"recvfrom",
|
|
|
|
|
"recvmmsg",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"recvmmsg_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"recvmsg",
|
|
|
|
|
"remap_file_pages",
|
|
|
|
|
"removexattr",
|
|
|
|
|
"rename",
|
|
|
|
|
"renameat",
|
|
|
|
|
"renameat2",
|
|
|
|
|
"restart_syscall",
|
|
|
|
|
"rmdir",
|
2020-06-26 09:33:50 -04:00
|
|
|
"rseq",
|
2016-07-13 09:41:30 -04:00
|
|
|
"rt_sigaction",
|
|
|
|
|
"rt_sigpending",
|
|
|
|
|
"rt_sigprocmask",
|
|
|
|
|
"rt_sigqueueinfo",
|
|
|
|
|
"rt_sigreturn",
|
|
|
|
|
"rt_sigsuspend",
|
|
|
|
|
"rt_sigtimedwait",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"rt_sigtimedwait_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"rt_tgsigqueueinfo",
|
|
|
|
|
"sched_getaffinity",
|
|
|
|
|
"sched_getattr",
|
|
|
|
|
"sched_getparam",
|
|
|
|
|
"sched_get_priority_max",
|
|
|
|
|
"sched_get_priority_min",
|
|
|
|
|
"sched_getscheduler",
|
|
|
|
|
"sched_rr_get_interval",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"sched_rr_get_interval_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"sched_setaffinity",
|
|
|
|
|
"sched_setattr",
|
|
|
|
|
"sched_setparam",
|
|
|
|
|
"sched_setscheduler",
|
|
|
|
|
"sched_yield",
|
|
|
|
|
"seccomp",
|
|
|
|
|
"select",
|
|
|
|
|
"semctl",
|
|
|
|
|
"semget",
|
|
|
|
|
"semop",
|
|
|
|
|
"semtimedop",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"semtimedop_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"send",
|
|
|
|
|
"sendfile",
|
|
|
|
|
"sendfile64",
|
|
|
|
|
"sendmmsg",
|
|
|
|
|
"sendmsg",
|
|
|
|
|
"sendto",
|
|
|
|
|
"setfsgid",
|
|
|
|
|
"setfsgid32",
|
|
|
|
|
"setfsuid",
|
|
|
|
|
"setfsuid32",
|
|
|
|
|
"setgid",
|
|
|
|
|
"setgid32",
|
|
|
|
|
"setgroups",
|
|
|
|
|
"setgroups32",
|
|
|
|
|
"setitimer",
|
|
|
|
|
"setpgid",
|
|
|
|
|
"setpriority",
|
|
|
|
|
"setregid",
|
|
|
|
|
"setregid32",
|
|
|
|
|
"setresgid",
|
|
|
|
|
"setresgid32",
|
|
|
|
|
"setresuid",
|
|
|
|
|
"setresuid32",
|
|
|
|
|
"setreuid",
|
|
|
|
|
"setreuid32",
|
|
|
|
|
"setrlimit",
|
|
|
|
|
"set_robust_list",
|
|
|
|
|
"setsid",
|
|
|
|
|
"setsockopt",
|
|
|
|
|
"set_thread_area",
|
|
|
|
|
"set_tid_address",
|
|
|
|
|
"setuid",
|
|
|
|
|
"setuid32",
|
|
|
|
|
"setxattr",
|
|
|
|
|
"shmat",
|
|
|
|
|
"shmctl",
|
|
|
|
|
"shmdt",
|
|
|
|
|
"shmget",
|
|
|
|
|
"shutdown",
|
|
|
|
|
"sigaltstack",
|
|
|
|
|
"signalfd",
|
|
|
|
|
"signalfd4",
|
2019-08-29 10:58:52 -04:00
|
|
|
"sigprocmask",
|
2016-07-13 09:41:30 -04:00
|
|
|
"sigreturn",
|
2017-05-09 09:21:19 -04:00
|
|
|
"socket",
|
|
|
|
|
"socketcall",
|
2016-07-13 09:41:30 -04:00
|
|
|
"socketpair",
|
|
|
|
|
"splice",
|
|
|
|
|
"stat",
|
|
|
|
|
"stat64",
|
|
|
|
|
"statfs",
|
|
|
|
|
"statfs64",
|
2018-02-26 15:25:55 -05:00
|
|
|
"statx",
|
2016-07-13 09:41:30 -04:00
|
|
|
"symlink",
|
|
|
|
|
"symlinkat",
|
|
|
|
|
"sync",
|
|
|
|
|
"sync_file_range",
|
|
|
|
|
"syncfs",
|
|
|
|
|
"sysinfo",
|
|
|
|
|
"tee",
|
|
|
|
|
"tgkill",
|
|
|
|
|
"time",
|
|
|
|
|
"timer_create",
|
|
|
|
|
"timer_delete",
|
|
|
|
|
"timer_getoverrun",
|
|
|
|
|
"timer_gettime",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"timer_gettime64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"timer_settime",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"timer_settime64",
|
|
|
|
|
"timerfd_create",
|
|
|
|
|
"timerfd_gettime",
|
|
|
|
|
"timerfd_gettime64",
|
|
|
|
|
"timerfd_settime",
|
|
|
|
|
"timerfd_settime64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"times",
|
|
|
|
|
"tkill",
|
|
|
|
|
"truncate",
|
|
|
|
|
"truncate64",
|
|
|
|
|
"ugetrlimit",
|
|
|
|
|
"umask",
|
|
|
|
|
"uname",
|
|
|
|
|
"unlink",
|
|
|
|
|
"unlinkat",
|
|
|
|
|
"utime",
|
|
|
|
|
"utimensat",
|
seccomp: add 64-bit time_t syscalls
Relates to https://patchwork.kernel.org/patch/10756415/
Added to whitelist:
- `clock_getres_time64` (equivalent of `clock_getres`, which was whitelisted)
- `clock_gettime64` (equivalent of `clock_gettime`, which was whitelisted)
- `clock_nanosleep_time64` (equivalent of `clock_nanosleep`, which was whitelisted)
- `futex_time64` (equivalent of `futex`, which was whitelisted)
- `io_pgetevents_time64` (equivalent of `io_pgetevents`, which was whitelisted)
- `mq_timedreceive_time64` (equivalent of `mq_timedreceive`, which was whitelisted)
- `mq_timedsend_time64 ` (equivalent of `mq_timedsend`, which was whitelisted)
- `ppoll_time64` (equivalent of `ppoll`, which was whitelisted)
- `pselect6_time64` (equivalent of `pselect6`, which was whitelisted)
- `recvmmsg_time64` (equivalent of `recvmmsg`, which was whitelisted)
- `rt_sigtimedwait_time64` (equivalent of `rt_sigtimedwait`, which was whitelisted)
- `sched_rr_get_interval_time64` (equivalent of `sched_rr_get_interval`, which was whitelisted)
- `semtimedop_time64` (equivalent of `semtimedop`, which was whitelisted)
- `timer_gettime64` (equivalent of `timer_gettime`, which was whitelisted)
- `timer_settime64` (equivalent of `timer_settime`, which was whitelisted)
- `timerfd_gettime64` (equivalent of `timerfd_gettime`, which was whitelisted)
- `timerfd_settime64` (equivalent of `timerfd_settime`, which was whitelisted)
- `utimensat_time64` (equivalent of `utimensat`, which was whitelisted)
Not added to whitelist:
- `clock_adjtime64` (equivalent of `clock_adjtime`, which was not whitelisted)
- `clock_settime64` (equivalent of `clock_settime`, which was not whitelisted)
Signed-off-by: Sebastiaan van Stijn <github@gone.nl>
2020-03-25 08:42:27 -04:00
|
|
|
"utimensat_time64",
|
2016-07-13 09:41:30 -04:00
|
|
|
"utimes",
|
|
|
|
|
"vfork",
|
|
|
|
|
"vmsplice",
|
|
|
|
|
"wait4",
|
|
|
|
|
"waitid",
|
|
|
|
|
"waitpid",
|
|
|
|
|
"write",
|
|
|
|
|
"writev"
|
|
|
|
|
],
|
2021-02-09 08:46:50 -05:00
|
|
|
"action": "SCMP_ACT_ALLOW"
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
2018-11-03 00:00:15 -04:00
|
|
|
{
|
|
|
|
|
"names": [
|
2021-03-04 12:12:01 -05:00
|
|
|
"process_vm_readv",
|
|
|
|
|
"process_vm_writev",
|
2018-11-03 00:00:15 -04:00
|
|
|
"ptrace"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
2019-02-05 14:31:44 -05:00
|
|
|
"minKernel": "4.8"
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2018-11-03 00:00:15 -04:00
|
|
|
},
|
2016-07-13 09:41:30 -04:00
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"personality"
|
|
|
|
|
],
|
2016-05-06 10:17:41 -04:00
|
|
|
"action": "SCMP_ACT_ALLOW",
|
2016-07-13 09:41:30 -04:00
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 0,
|
|
|
|
|
"value": 0,
|
|
|
|
|
"op": "SCMP_CMP_EQ"
|
|
|
|
|
}
|
2021-02-09 08:46:50 -05:00
|
|
|
]
|
2016-05-06 10:17:41 -04:00
|
|
|
},
|
2016-02-08 11:19:21 -05:00
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"names": [
|
|
|
|
|
"personality"
|
|
|
|
|
],
|
2016-02-18 00:06:07 -05:00
|
|
|
"action": "SCMP_ACT_ALLOW",
|
2016-07-13 09:41:30 -04:00
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 0,
|
|
|
|
|
"value": 8,
|
|
|
|
|
"op": "SCMP_CMP_EQ"
|
|
|
|
|
}
|
2021-02-09 08:46:50 -05:00
|
|
|
]
|
2016-02-08 11:19:21 -05:00
|
|
|
},
|
2017-05-02 10:05:01 -04:00
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"personality"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 0,
|
|
|
|
|
"value": 131072,
|
|
|
|
|
"op": "SCMP_CMP_EQ"
|
|
|
|
|
}
|
2021-02-09 08:46:50 -05:00
|
|
|
]
|
2017-05-02 10:05:01 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"personality"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 0,
|
|
|
|
|
"value": 131080,
|
|
|
|
|
"op": "SCMP_CMP_EQ"
|
|
|
|
|
}
|
2021-02-09 08:46:50 -05:00
|
|
|
]
|
2017-05-02 10:05:01 -04:00
|
|
|
},
|
2016-05-06 10:17:41 -04:00
|
|
|
{
|
2016-07-13 09:41:30 -04:00
|
|
|
"names": [
|
|
|
|
|
"personality"
|
|
|
|
|
],
|
2016-05-06 10:17:41 -04:00
|
|
|
"action": "SCMP_ACT_ALLOW",
|
2016-07-13 09:41:30 -04:00
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 0,
|
|
|
|
|
"value": 4294967295,
|
|
|
|
|
"op": "SCMP_CMP_EQ"
|
|
|
|
|
}
|
2021-02-09 08:46:50 -05:00
|
|
|
]
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
2017-02-13 07:55:53 -05:00
|
|
|
{
|
|
|
|
|
"names": [
|
2021-12-18 08:06:07 -05:00
|
|
|
"sync_file_range2",
|
|
|
|
|
"swapcontext"
|
2017-02-13 07:55:53 -05:00
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"ppc64le"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2017-02-13 07:55:53 -05:00
|
|
|
},
|
2016-07-13 09:41:30 -04:00
|
|
|
{
|
|
|
|
|
"names": [
|
2017-01-29 09:53:15 -05:00
|
|
|
"arm_fadvise64_64",
|
|
|
|
|
"arm_sync_file_range",
|
2017-02-13 07:55:53 -05:00
|
|
|
"sync_file_range2",
|
2016-07-13 09:41:30 -04:00
|
|
|
"breakpoint",
|
|
|
|
|
"cacheflush",
|
|
|
|
|
"set_tls"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"arm",
|
|
|
|
|
"arm64"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"arch_prctl"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"amd64",
|
|
|
|
|
"x32"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"modify_ldt"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"amd64",
|
|
|
|
|
"x32",
|
|
|
|
|
"x86"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"s390_pci_mmio_read",
|
|
|
|
|
"s390_pci_mmio_write",
|
|
|
|
|
"s390_runtime_instr"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"s390",
|
|
|
|
|
"s390x"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2022-05-02 04:08:56 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"riscv_flush_icache"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"riscv64"
|
|
|
|
|
]
|
|
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"open_by_handle_at"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_DAC_READ_SEARCH"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"bpf",
|
|
|
|
|
"clone",
|
2021-07-26 14:10:01 -04:00
|
|
|
"clone3",
|
2016-07-13 09:41:30 -04:00
|
|
|
"fanotify_init",
|
2021-01-17 07:39:31 -05:00
|
|
|
"fsconfig",
|
|
|
|
|
"fsmount",
|
|
|
|
|
"fsopen",
|
|
|
|
|
"fspick",
|
2016-07-13 09:41:30 -04:00
|
|
|
"lookup_dcookie",
|
|
|
|
|
"mount",
|
2022-05-13 05:20:48 -04:00
|
|
|
"mount_setattr",
|
2021-01-17 07:39:31 -05:00
|
|
|
"move_mount",
|
2016-07-13 09:41:30 -04:00
|
|
|
"name_to_handle_at",
|
2021-01-17 07:39:31 -05:00
|
|
|
"open_tree",
|
2016-07-13 09:41:30 -04:00
|
|
|
"perf_event_open",
|
2017-08-08 13:01:53 -04:00
|
|
|
"quotactl",
|
2022-05-13 05:20:48 -04:00
|
|
|
"quotactl_fd",
|
2016-07-13 09:41:30 -04:00
|
|
|
"setdomainname",
|
|
|
|
|
"sethostname",
|
|
|
|
|
"setns",
|
2018-09-27 17:27:05 -04:00
|
|
|
"syslog",
|
2016-07-13 09:41:30 -04:00
|
|
|
"umount",
|
|
|
|
|
"umount2",
|
|
|
|
|
"unshare"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_ADMIN"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"clone"
|
|
|
|
|
],
|
2016-05-06 10:17:41 -04:00
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 0,
|
2019-06-03 13:58:58 -04:00
|
|
|
"value": 2114060288,
|
2016-05-06 10:17:41 -04:00
|
|
|
"op": "SCMP_CMP_MASKED_EQ"
|
|
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
],
|
|
|
|
|
"excludes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_ADMIN"
|
|
|
|
|
],
|
|
|
|
|
"arches": [
|
|
|
|
|
"s390",
|
|
|
|
|
"s390x"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"clone"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"args": [
|
|
|
|
|
{
|
|
|
|
|
"index": 1,
|
2019-06-03 13:58:58 -04:00
|
|
|
"value": 2114060288,
|
2016-07-13 09:41:30 -04:00
|
|
|
"op": "SCMP_CMP_MASKED_EQ"
|
|
|
|
|
}
|
|
|
|
|
],
|
|
|
|
|
"comment": "s390 parameter ordering for clone is different",
|
|
|
|
|
"includes": {
|
|
|
|
|
"arches": [
|
|
|
|
|
"s390",
|
|
|
|
|
"s390x"
|
|
|
|
|
]
|
|
|
|
|
},
|
|
|
|
|
"excludes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_ADMIN"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
2021-07-26 14:10:01 -04:00
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"clone3"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ERRNO",
|
|
|
|
|
"errnoRet": 38,
|
|
|
|
|
"excludes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_ADMIN"
|
|
|
|
|
]
|
|
|
|
|
}
|
|
|
|
|
},
|
2016-07-13 09:41:30 -04:00
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"reboot"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_BOOT"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"chroot"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_CHROOT"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"delete_module",
|
|
|
|
|
"init_module",
|
2020-05-18 21:30:54 -04:00
|
|
|
"finit_module"
|
2016-07-13 09:41:30 -04:00
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_MODULE"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"acct"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_PACCT"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"kcmp",
|
2020-11-11 07:33:52 -05:00
|
|
|
"pidfd_getfd",
|
2021-01-17 07:39:31 -05:00
|
|
|
"process_madvise",
|
2016-07-13 09:41:30 -04:00
|
|
|
"process_vm_readv",
|
|
|
|
|
"process_vm_writev",
|
|
|
|
|
"ptrace"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_PTRACE"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"iopl",
|
|
|
|
|
"ioperm"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_RAWIO"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"settimeofday",
|
|
|
|
|
"stime",
|
2017-03-20 06:00:34 -04:00
|
|
|
"clock_settime"
|
2016-07-13 09:41:30 -04:00
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_TIME"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-07-13 09:41:30 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"vhangup"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_TTY_CONFIG"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2018-06-08 11:41:48 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"get_mempolicy",
|
|
|
|
|
"mbind",
|
|
|
|
|
"set_mempolicy"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYS_NICE"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2018-09-27 17:27:05 -04:00
|
|
|
},
|
|
|
|
|
{
|
|
|
|
|
"names": [
|
|
|
|
|
"syslog"
|
|
|
|
|
],
|
|
|
|
|
"action": "SCMP_ACT_ALLOW",
|
|
|
|
|
"includes": {
|
|
|
|
|
"caps": [
|
|
|
|
|
"CAP_SYSLOG"
|
|
|
|
|
]
|
2021-02-09 08:46:50 -05:00
|
|
|
}
|
2016-02-08 11:19:21 -05:00
|
|
|
}
|
|
|
|
|
]
|
|
|
|
|
}
|